Drop groupIds from customer data-access filters; keep visibility via group assignees only.

Co-authored-by: Cursor <cursoragent@cursor.com>

.cursor/rules/antd-strict-governance.mdc

@@ -41,19 +41,11 @@ Legacy CRM UI (`components/ui/*`, `.crm-*`, `.btn` / `.field` in `styles/`) rema
 6. **24-column grid only**  
    Page layout on migrated screens uses Ant Grid: `a-row` / `a-col` with the **24-column** system (`:span`, `:xs`, `:sm`, `:md`, `:lg`, `:xl`). Do not invent parallel flex/grid CSS layouts for page chrome.
 
-7. **RTL + locale + StyleProvider**  
-   App root in `App.vue` **must** wrap ConfigProvider with `<a-style-provider hash-priority="high">` so legacy `main.css` cannot override Ant controls via higher specificity:
-   ```vue
-   <a-style-provider hash-priority="high">
-     <a-config-provider direction="rtl" :locale="faIR" :theme="antdTheme">
-       <RouterView />
-     </a-config-provider>
-   </a-style-provider>
-   ```
-   Do not override direction to LTR on whole pages; use local `direction="ltr"` only for inherently LTR fragments (e.g. phone numbers, codes).
+7. **RTL + locale**  
+   App root is wrapped with `<a-config-provider direction="rtl" :locale="faIR" :theme="antdTheme">`. Do not override direction to LTR on whole pages; use local `direction="ltr"` only for inherently LTR fragments (e.g. phone numbers, codes).
 
 8. **Auto-import**  
-   `<a-*>` components are resolved via `unplugin-vue-components` + `AntDesignVueResolver({ importStyle: false })`. Do not add blanket `app.use(antd)` unless there is a documented exception. Do not per-component CSS imports (`importStyle` stays `false`; CSS-in-JS + theme). Prefer **explicit** `import { Button as AButton, … } from 'ant-design-vue'` in migrated files when the Vite resolver is missing or unreliable.
+   `<a-*>` components are resolved via `unplugin-vue-components` + `AntDesignVueResolver({ importStyle: false })`. Do not add blanket `app.use(antd)` unless there is a documented exception. Do not per-component CSS imports (`importStyle` stays `false`; CSS-in-JS + theme).
 
 9. **Theme is central**  
    Visual tokens (primary, radius, `controlHeight`, padding/margin scale, shadows, Form/Card overrides) live only in `antdTheme.ts`. Do not fork theme objects inside views.

.cursor/settings.json

@@ -1,7 +0,0 @@
-{
-  "plugins": {
-    "hex": {
-      "enabled": true
-    }
-  }
-}

.cursor/skills/antd-system-architect/SKILL.md

@@ -38,13 +38,9 @@ Also read and obey [`.cursor/rules/antd-strict-governance.mdc`](../../rules/antd
 | Dependency | `ant-design-vue` ^4, `@ant-design/icons-vue`, `unplugin-vue-components` in `@mento/web` |
 | Vite plugin | `apps/web/vite.config.ts` — `Components` + `AntDesignVueResolver` |
 | Theme | `apps/web/src/theme/antdTheme.ts` (`controlHeight: 36`) |
-| RTL + locale + theme + StyleProvider | `apps/web/src/App.vue` — `<a-style-provider hash-priority="high">` wrapping `<a-config-provider direction="rtl" :locale="faIR" :theme="antdTheme">` (mandatory so legacy `main.css` cannot override Ant) |
+| RTL + locale + theme | `apps/web/src/App.vue` — `<a-config-provider direction="rtl" :locale="faIR" :theme="antdTheme">` |
 | Legacy kit (do not touch) | `apps/web/src/components/ui/*`, `styles/main.css` utilities |
 
-### Mandatory child-control conversion (same pass)
-
-هنگام بازنویسی یک صفحه (View)، ایجنت موظف است علاوه بر خود فایل View، تمام کامپوننت‌های فرزندی را که در آن View ایمپورت شده‌اند و حاوی اینپوت/سلکت/دکمه هستند نیز بازبینی کرده و درون آن‌ها را به کامپوننت‌های رسمی `ant-design-vue` تبدیل کند. هیچ تگ `<input>`, `<select>`, `<textarea>`, `<button>` خامی نباید در صفحه یا کامپوننت‌های فرزندِ مصرفی آن باقی بماند.
-
 ## Migration workflow
 
 1. Confirm the **single** route/view the user named.

.dockerignore

@@ -0,0 +1,15 @@
+.git
+node_modules
+**/dist
+**/.env
+**/.env.*
+apps/stt/.venv
+uploads
+docs
+e2e
+test-results
+playwright-report
+graphify-out
+.worktrees
+*.md
+crm-node_modules.tgz

.gitea/workflows/build.yml

@@ -0,0 +1,129 @@
+name: Build & Push Docker Image
+
+on:
+  push:
+    tags:
+      - "*"
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Start time
+        run: echo "BUILD_STARTED=$(date +%s)" >> "$GITHUB_ENV"
+
+      - name: Free disk space
+        id: prune
+        run: |
+          df -h / /workspace /var/lib/containerd 2>/dev/null || df -h /
+          docker builder prune -af || true
+          docker image prune -af || true
+          docker system prune -af --volumes || true
+          df -h / /workspace /var/lib/containerd 2>/dev/null || df -h /
+
+      - name: Checkout code
+        id: checkout
+        uses: actions/checkout@v4
+
+      - name: Resolve image tag
+        id: meta
+        run: |
+          if [ "${GITHUB_REF_TYPE}" = "tag" ]; then
+            TAG="${GITHUB_REF_NAME}"
+          else
+            TAG="$(git rev-parse --short HEAD)"
+          fi
+          echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
+          echo "registry=dock.monsys.ir" >> "$GITHUB_OUTPUT"
+
+      - name: Build Docker images
+        id: build
+        run: |
+          set -eu
+          tag="${{ steps.meta.outputs.tag }}"
+          reg="${{ steps.meta.outputs.registry }}"
+          docker build -f Dockerfile.api -t "$reg/montact-api:$tag" -t "$reg/montact-api:latest" .
+          docker build -f Dockerfile.web -t "$reg/montact-web:$tag" -t "$reg/montact-web:latest" .
+          docker build -f Dockerfile.stt -t "$reg/montact-stt:$tag" -t "$reg/montact-stt:latest" .
+
+      # Registry login is unsolved. These two steps stay off so a tag run
+      # only proves the three images build. Remove `if: false` on both when
+      # dock.monsys.ir accepts the runner.
+      - name: Login to registry
+        id: login
+        env:
+          REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
+          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
+        run: |
+          USER_NAME="${REGISTRY_USERNAME:-admin}"
+          printf '%s\n' "$REGISTRY_PASSWORD" | docker login "dock.monsys.ir" -u "$USER_NAME" --password-stdin
+
+      - name: Push Docker images
+        id: push
+        run: |
+          set -eu
+          tag="${{ steps.meta.outputs.tag }}"
+          reg="${{ steps.meta.outputs.registry }}"
+          for name in montact-api montact-web montact-stt; do
+            docker push "$reg/$name:$tag"
+            docker push "$reg/$name:latest"
+          done
+
+      - name: Notify Bale
+        if: always()
+        continue-on-error: true
+        env:
+          BALE_TOKEN: ${{ secrets.BALE_BOT_TOKEN || vars.BALE_BOT_TOKEN }}
+          BALE_CHAT_ID: ${{ vars.BALE_CHAT_ID }}
+          TAG: ${{ steps.meta.outputs.tag }}
+          REG: ${{ steps.meta.outputs.registry }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_number }}
+          STEP_OUTCOMES: |
+            Checkout code=${{ steps.checkout.outcome }}
+            Resolve image tag=${{ steps.meta.outcome }}
+            Build Docker images=${{ steps.build.outcome }}
+            Login to registry=${{ steps.login.outcome }}
+            Push Docker images=${{ steps.push.outcome }}
+        run: |
+          if [ -z "$BALE_TOKEN" ] || [ -z "$BALE_CHAT_ID" ]; then
+            echo "BALE_BOT_TOKEN / BALE_CHAT_ID not set in Gitea — skipping notification"
+            exit 0
+          fi
+
+          failed_step=$(printf '%s\n' "$STEP_OUTCOMES" | grep -E '=(failure|cancelled)$' | head -n1 | cut -d= -f1)
+          if [ -n "$failed_step" ]; then
+            title="❌ بیلد ناموفق"
+          elif printf '%s\n' "$STEP_OUTCOMES" | grep -q '^Push Docker images=success$'; then
+            title="✅ بیلد موفق"
+          elif printf '%s\n' "$STEP_OUTCOMES" | grep -q '^Build Docker images=success$'; then
+            title="✅ بیلد موفق؛ پوش رجیستری هنوز خاموش است"
+          else
+            title="⚠️ بیلد کامل نشد"
+          fi
+
+          commit=$(git log -1 --pretty='%h — %s' 2>/dev/null || echo "${GITHUB_SHA:0:7}")
+          elapsed=$(( $(date +%s) - ${BUILD_STARTED:-$(date +%s)} ))
+
+          text="${title}
+          پروژه: ${GITHUB_REPOSITORY}
+          تگ: ${TAG:-${GITHUB_REF_NAME}}"
+          if [ -z "$failed_step" ] && [ -n "$TAG" ]; then
+            text="${text}
+          image: ${REG}/montact-api:${TAG}
+          image: ${REG}/montact-web:${TAG}
+          image: ${REG}/montact-stt:${TAG}"
+          fi
+          [ -n "$failed_step" ] && text="${text}
+          مرحلهٔ خطا: ${failed_step}"
+          text="${text}
+          کامیت: ${commit}
+          توسط: ${GITHUB_ACTOR}
+          مدت: $((elapsed / 60))m$((elapsed % 60))s
+          لاگ: ${RUN_URL}"
+          msg_file=$(mktemp)
+          printf '%s\n' "$text" | sed 's/^[[:space:]]*//' > "$msg_file"
+
+          curl -sS -m 20 -X POST "https://tapi.bale.ai/bot${BALE_TOKEN}/sendMessage" \
+            --data-urlencode "chat_id=${BALE_CHAT_ID}" \
+            --data-urlencode "text@${msg_file}"

Dockerfile.api

@@ -0,0 +1,29 @@
+# NestJS API + Prisma. Build context is the monorepo root.
+FROM node:20-bookworm-slim AS build
+WORKDIR /app
+COPY package.json package-lock.json ./
+COPY apps/api/package.json apps/api/package.json
+COPY apps/web/package.json apps/web/package.json
+COPY packages/shared/package.json packages/shared/package.json
+RUN npm ci
+COPY apps/api apps/api
+COPY packages/shared packages/shared
+RUN npm run build -w @mento/shared \
+ && npm run prisma:generate -w @mento/api \
+ && npm run build -w @mento/api
+
+FROM node:20-bookworm-slim
+WORKDIR /app
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends openssl ca-certificates \
+ && rm -rf /var/lib/apt/lists/*
+COPY --from=build /app/package.json /app/package-lock.json ./
+COPY --from=build /app/node_modules ./node_modules
+COPY --from=build /app/packages/shared ./packages/shared
+COPY --from=build /app/apps/api/package.json ./apps/api/package.json
+COPY --from=build /app/apps/api/dist ./apps/api/dist
+COPY --from=build /app/apps/api/prisma ./apps/api/prisma
+WORKDIR /app/apps/api
+ENV NODE_ENV=production
+EXPOSE 3000
+CMD ["node", "dist/src/main.js"]

Dockerfile.stt

@@ -0,0 +1,15 @@
+# Local Faster-Whisper. Not published on Ingress.
+FROM python:3.11-slim-bookworm
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends ffmpeg \
+ && rm -rf /var/lib/apt/lists/*
+WORKDIR /app
+COPY apps/stt/requirements.txt ./requirements.txt
+RUN pip install --no-cache-dir -r requirements.txt
+COPY apps/stt/main.py ./main.py
+ENV STT_MODEL=small \
+    STT_DEVICE=cpu \
+    STT_COMPUTE_TYPE=int8 \
+    HF_HOME=/models
+EXPOSE 3040
+CMD ["uvicorn", "main:app", "--host", "0.0.0.0", "--port", "3040"]

Dockerfile.web

@@ -0,0 +1,16 @@
+# Vue panel. The built app calls /api on the same host; Traefik sends that to the API.
+FROM node:20-bookworm-slim AS build
+WORKDIR /app
+COPY package.json package-lock.json ./
+COPY apps/api/package.json apps/api/package.json
+COPY apps/web/package.json apps/web/package.json
+COPY packages/shared/package.json packages/shared/package.json
+RUN npm ci
+COPY apps/web apps/web
+COPY packages/shared packages/shared
+RUN npm run build -w @mento/shared && npm run build -w @mento/web
+
+FROM nginx:1.27-alpine
+COPY docker/web.nginx.conf /etc/nginx/conf.d/default.conf
+COPY --from=build /app/apps/web/dist /usr/share/nginx/html
+EXPOSE 80

antd-strict-governance.mdc.md

@@ -1,65 +0,0 @@
----
-description: حاکمیت مطلق معماری رابط کاربری بر پایه Ant Design Vue v4، قفل مهاجرت صفحه به صفحه، ممنوعیت کامل CSS دستی و استاندارد ریاضی چیدمان
-globs: apps/web/src/**/*.{vue,ts,tsx,css}
-alwaysApply: true
----
-
-# قرارداد حاکمیتی و غیرقابل‌مذاکرهٔ رابط کاربری (Ant Design Vue v4 Strict Contract)
-
-تنها منبع مجاز برای ساخت و بازنویسی عناصر رابط کاربری در این پروژه `ant-design-vue` (نسخه ۴) است. هرگونه تخطی از قوانین زیر خطای معماری محسوب می‌شود:
-
-## ۱. قفل ایزولاسیون و مهاجرت صفحه به صفحه (Single-Page Blast Radius Lock)
-1. **ممنوعیت ویرایش دسته‌جمعی:** تو فقط و فقط مجاز به ویرایش صفحه (View) یا کامپوننتی هستی که کاربر صراحتاً در همان نوبت نام برده است. دست زدن به سایر صفحات پروژه مطلقاً ممنوع است.
-2. **حفظ لایهٔ قدیمی برای صفحات مهاجرت‌نکرده:** فایل‌های داخل `apps/web/src/components/ui/Ui*.vue` و استایل‌های سراسری `main.css` / `tokens.css` نباید حذف یا ویرایش شوند تا صفحات قدیمی پروژه بدون خطا به کار خود ادامه دهند.
-3. **قطع کامل وابستگی در صفحهٔ هدف:** در صفحه‌ای که کاربر دستور بازنویسی آن را می‌دهد، تمام ایمپورت‌های `@/components/ui` و کلاس‌های قدیمی باید از آن فایل حذف شوند و ۱۰۰٪ با کامپوننت‌های رسمی `<a-...>` جایگزین گردند.
-4. **کامپوننت‌های تخصصی تاریخ شمسی و مبالغ:** در صفحات بازنویسی‌شده، اگر از `JalaliDateInput` یا `MoneyInput` استفاده شده است، منطق آن‌ها را حفظ کن اما مطمئن شو ظاهر ورودی آن‌ها با ارتفاع `40px`، ردیوس `10px` و عرض `style="width: 100%"` کاملاً هم‌تراز با فیلدهای Ant Design نمایش داده می‌شود.
-
-## ۲. لیست سیاه سینتکس و تگ‌های ممنوعه در صفحات بازنویسی‌شده (Banned Syntax)
-در هر فایلی که بازنویسی یا ایجاد می‌کنی، وجود موارد زیر خطای بحرانی است و باید فوراً حذف شوند:
-- **تگ‌های خام HTML برای فرم و جدول:** `<button>`, `<input>`, `<select>`, `<textarea>`, `<label>`, `<form>`, `<table>`, `<thead>`, `<tbody>`, `<tr>`, `<td>`.
-- **کلاس‌های لگسی پروژه:** `.btn`, `.btn-primary`, `.btn-ghost`, `.btn-danger`, `.btn-save`, `.field`, `.crm-page`, `.crm-page-header`, `.crm-card`, `.crm-table`, `.crm-empty-state`.
-- **کلاس‌های Tailwind (پروژه فاقد Tailwind است):** استفاده از کلاس‌های ناموجود مانند `w-full`, `flex`, `gap-4`, `p-4`, `mb-4` مطلقاً ممنوع است. برای عرض کامل کنترل‌ها فقط از `style="width: 100%"` یا پراپ `block` استفاده کن.
-
-## ۳. قوانین ریاضی چیدمان، گرید و ریتم فضایی (Spatial & Layout Mathematics)
-1. **ممنوعیت تکه‌تکه کردن فرم به کارت‌های متعدد (Anti-Card-Fragmentation):**
-   - خرد کردن یک فرم به چندین باکس یا کارت مجزا زیر هم ممنوع است.
-   - کل فیلدهای یک فرم اصلی باید در **حداکثر ۱ `<a-card :bordered="false">`** تجمیع شوند.
-   - برای تفکیک بخش‌های منطقی در داخل آن کارت واحد، فقط از `<a-divider orientation="right">عنوان بخش</a-divider>` استفاده کن.
-2. **چیدمان استاندارد دو ستونه (فرم اصلی + پنل خلاصه):**
-   - ردیف اصلی صفحه: `<a-row :gutter="[24, 24]">`
-   - ستون اصلی (فرم/محتوا): `<a-col :xs="24" :lg="17" :xl="18">`
-   - ستون کناری (خلاصه وضعیت): `<a-col :xs="24" :lg="7" :xl="6">` همراه با `<a-affix :offset-top="24">`.
-   - محتوای پنل خلاصه باید الزاماً با `<a-descriptions :column="1" size="small" bordered>` داخل `<a-card title="..." :bordered="false">` پیاده‌سازی شود، نه با `div` و `span` دستی.
-3. **قانون عرض فیلدها در فرم (Form Grid Allocation):**
-   - تمام فرم‌ها باید `<a-form layout="vertical" :model="...">` باشند و تمام فیلدها بدون استثنا داخل `<a-form-item label="..." name="...">` قرار گیرند.
-   - رها کردن فیلدهای کوتاه در عرض ۱۰۰٪ (`span="24"`) ممنوع است. چیدمان درون فرم باید با `<a-row :gutter="[16, 0]">` به شکل زیر باشد:
-     - **فیلدهای کوتاه** (تاریخ، ساعت، مدت زمان، مبلغ، وضعیت، نوع، کد): `<a-col :xs="24" :sm="12" :md="8">` (۳ ستونه).
-     - **فیلدهای متوسط** (انتخاب مشتری، مسئول انجام، فرصت مرتبط، دسته‌بندی، عنوان): `<a-col :xs="24" :md="12">` (۲ ستونه).
-     - **فیلدهای تمام‌عرض** (توضیحات، یادداشت، چک‌لیست، برچسب‌ها): `<a-col :span="24">`.
-     - **سوییچ‌ها و چک‌باکس‌های هم‌خانواده:** قرارگیری در یک ردیف با `<a-space :size="24" wrap>`.
-4. **مدیریت Margin و Padding بدون CSS دستی:**
-   - فاصلهٔ عمودی فیلدها فقط توسط `itemMarginBottom` در کانفیگ تم `<a-form-item>` کنترل می‌شود.
-   - فاصلهٔ افقی/عمودی دکمه‌ها و المان‌ها فقط با `<a-space :size="8 | 12 | 16">` یا `<a-flex gap="small | middle | large" align="center" justify="space-between">` کنترل می‌شود.
-
-## ۴. قفل سینتکس اختصاصی Ant Design Vue v4
-- **بایندینگ مقدار (`v-model`):** استفاده از `v-model="..."` بدون آرگومان روی کامپوننت‌های Ant Design Vue خطاست:
-  - برای `a-input`, `a-textarea`, `a-input-number`, `a-select`, `a-radio-group`, `a-segmented`, `a-date-picker`, `a-time-picker`: الزاماً `v-model:value="..."`.
-  - برای `a-checkbox`, `a-switch`: الزاماً `v-model:checked="..."`.
-  - برای `a-modal`, `a-drawer`, `a-dropdown`, `a-popover`, `a-tooltip`: الزاماً `v-model:open="..."` (پراپ `:visible` منسوخ و ممنوع است).
-- **الزام عرض ۱۰۰٪ روی کنترل‌های خاص:** کامپوننت‌های `<a-input-number>`, `<a-date-picker>`, `<a-time-picker>` و `<a-select>` در داخل `<a-form-item>` باید دارای `style="width: 100%"` باشند.
-- **فیدبک و پیام‌ها:** برای نمایش پیام از `import { message, notification, Modal } from 'ant-design-vue'` استفاده کن.
-
-## ۵. حاکمیت مطلق توکن‌ها و ممنوعیت CSS دستی (Zero Manual Styling & RTL Lock)
-1. نوشتن کد رنگ (`#hex`, `rgb`, `rgba`, `hsl`)، سایه (`box-shadow`)، ردیوس (`border-radius`) و فاصله‌های دستی (`margin`, `padding` با `px`/`rem`) در `<style scoped>` ممنوع است.
-2. تمام تنظیمات ظاهری (ردیوس، شدو، ارتفاع کنترل‌ها، پدینگ و رنگ‌ها) فقط در فایل مرکزی `apps/web/src/theme/antdTheme.ts` تعریف می‌شوند.
-3. در صورت نیاز ضروری به خواندن توکن در یک کانتینر، فقط از هوک `const { token } = theme.useToken()` در `ant-design-vue` استفاده کن.
-4. استفاده از `:deep(.ant-...)` برای دست‌کاری ظاهر کامپوننت‌های انت ممنوع است.
-5. در RTL، استفاده از `left`, `right`, `margin-left`, `margin-right`, `padding-left`, `padding-right` ممنوع است؛ فقط از خواص منطقی (`inset-inline-start`, `inset-inline-end`, `margin-inline`, `padding-inline`) استفاده شود.
-
-## ۶. گیت خودارزیابی پیش از تحویل کد (Self-Verification Gate)
-قبل از اتمام کار روی فایلِ درخواستی، این ۵ شرط را بررسی کن:
-- [ ] آیا فقط فایل درخواستی کاربر ویرایش شده و سایر صفحات دست‌نخورده مانده‌اند؟
-- [ ] آیا تمام تگ‌های خام فرم، کامپوننت‌های `Ui*`، کلاس‌های `.btn`/`.field`/`.crm-*` و کلاس‌های ناموجود مثل `w-full` از این صفحه حذف شده‌اند؟
-- [ ] آیا فرم در ۱ کارت واحد با `<a-divider>` و گرید `<a-row :gutter="[16, 0]">` چیده شده و فیلدهای کوتاه از حالت تمام‌عرض خارج شده‌اند؟
-- [ ] آیا تمام بایندینگ‌ها از `v-model:value`، `v-model:checked` و `v-model:open` به همراه `style="width: 100%"` روی سلکت‌ها و شمارنده‌ها استفاده می‌کنند؟
-- [ ] آیا `<style scoped>` کاملاً از رنگ‌های Hex، مارجین/پدینگ دستی، ردیوس، شدو و `:deep(.ant-*)` پاک‌سازی شده است؟

apps/api/prisma/migrations/20261103210000_activity_board_position/migration.sql

@@ -0,0 +1,3 @@
+ALTER TABLE "Activity" ADD COLUMN "boardPosition" INTEGER NOT NULL DEFAULT 0;
+
+CREATE INDEX "Activity_stageId_boardPosition_idx" ON "Activity"("stageId", "boardPosition");

apps/api/prisma/migrations/20261104090000_role_treasury_accounts/migration.sql

@@ -0,0 +1 @@
+ALTER TABLE "OrgRole" ADD COLUMN "treasuryAccountIds" TEXT[] NOT NULL DEFAULT ARRAY[]::TEXT[];

apps/api/prisma/migrations/20261104110000_role_treasury_own_accounts/migration.sql

@@ -0,0 +1 @@
+ALTER TABLE "OrgRole" ADD COLUMN "treasuryOwnAccounts" BOOLEAN NOT NULL DEFAULT false;

apps/api/prisma/migrations/20261104120000_user_treasury_access/migration.sql

@@ -0,0 +1 @@
+ALTER TABLE "Membership" ADD COLUMN "treasuryAccessOverride" JSONB;

apps/api/prisma/migrations/20261104140000_financial_document_party/migration.sql

@@ -0,0 +1,9 @@
+ALTER TABLE "FinancialDocument" ADD COLUMN "companyId" TEXT;
+ALTER TABLE "FinancialDocument" ADD COLUMN "userId" TEXT;
+ALTER TABLE "FinancialDocument" ADD COLUMN "partyKind" TEXT;
+
+CREATE INDEX "FinancialDocument_companyId_idx" ON "FinancialDocument"("companyId");
+CREATE INDEX "FinancialDocument_userId_idx" ON "FinancialDocument"("userId");
+
+ALTER TABLE "FinancialDocument" ADD CONSTRAINT "FinancialDocument_companyId_fkey" FOREIGN KEY ("companyId") REFERENCES "Company"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+ALTER TABLE "FinancialDocument" ADD CONSTRAINT "FinancialDocument_userId_fkey" FOREIGN KEY ("userId") REFERENCES "User"("id") ON DELETE SET NULL ON UPDATE CASCADE;

apps/api/prisma/migrations/20261105103000_data_fix_flag/migration.sql

@@ -0,0 +1,6 @@
+CREATE TABLE "DataFix" (
+    "key" TEXT NOT NULL,
+    "doneAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "DataFix_pkey" PRIMARY KEY ("key")
+);

apps/api/prisma/migrations/20261105140000_tahesab_customer_sync_hours/migration.sql

@@ -0,0 +1,6 @@
+ALTER TABLE "AccountingConnection"
+  ADD COLUMN "customerSyncHours" INTEGER[] NOT NULL DEFAULT ARRAY[]::INTEGER[],
+  ADD COLUMN "customerSyncLastSlot" TEXT,
+  ADD COLUMN "customerSyncLastRunAt" TIMESTAMP(3),
+  ADD COLUMN "customerSyncLastSummary" TEXT,
+  ADD COLUMN "customerSyncLastError" TEXT;

apps/api/prisma/migrations/20261107120000_voip_daftareshoma/migration.sql

@@ -0,0 +1,10 @@
+-- AlterTable
+ALTER TABLE "VoipConnection" ADD COLUMN "provider" TEXT NOT NULL DEFAULT 'generic';
+ALTER TABLE "VoipConnection" ADD COLUMN "apiTokenCiphertext" TEXT;
+ALTER TABLE "VoipConnection" ADD COLUMN "apiTokenIv" TEXT;
+ALTER TABLE "VoipConnection" ADD COLUMN "apiTokenTag" TEXT;
+ALTER TABLE "VoipConnection" ADD COLUMN "fromNumber" TEXT;
+ALTER TABLE "VoipConnection" ADD COLUMN "callerExtension" TEXT;
+
+-- CreateIndex
+CREATE INDEX "VoipConnection_organizationId_provider_idx" ON "VoipConnection"("organizationId", "provider");

apps/api/prisma/migrations/20261107140000_voip_call_line_extension/migration.sql

@@ -0,0 +1,8 @@
+-- AlterTable
+ALTER TABLE "VoipCallLog" ADD COLUMN "lineExtension" TEXT;
+
+-- CreateIndex
+CREATE INDEX "VoipCallLog_organizationId_lineExtension_idx" ON "VoipCallLog"("organizationId", "lineExtension");
+
+-- CreateIndex
+CREATE INDEX "VoipCallLog_organizationId_status_idx" ON "VoipCallLog"("organizationId", "status");

apps/api/prisma/migrations/20261108133000_payroll_amount_reasons/migration.sql

@@ -0,0 +1,4 @@
+-- AlterTable
+ALTER TABLE "FinancialPayroll" ADD COLUMN "benefitsReason" TEXT;
+ALTER TABLE "FinancialPayroll" ADD COLUMN "bonusReason" TEXT;
+ALTER TABLE "FinancialPayroll" ADD COLUMN "deductionsReason" TEXT;

apps/api/prisma/migrations/20261109170000_activity_completion_mode/migration.sql

@@ -0,0 +1,6 @@
+-- CreateEnum
+CREATE TYPE "ActivityCompletionMode" AS ENUM ('any', 'all');
+
+-- AlterTable
+ALTER TABLE "Activity" ADD COLUMN "completionMode" "ActivityCompletionMode" NOT NULL DEFAULT 'any',
+ADD COLUMN "completedByIds" TEXT[] NOT NULL DEFAULT ARRAY[]::TEXT[];

apps/api/prisma/migrations/20261111160000_activity_edit_policy/migration.sql

@@ -0,0 +1,5 @@
+-- CreateEnum
+CREATE TYPE "ActivityEditPolicy" AS ENUM ('creator', 'assignees');
+
+-- AlterTable
+ALTER TABLE "Activity" ADD COLUMN "editPolicy" "ActivityEditPolicy" NOT NULL DEFAULT 'creator';

apps/api/prisma/migrations/20261112120000_customer_group_assignees/migration.sql

@@ -0,0 +1,28 @@
+-- مسئولان اختیاری روی گروه‌های مشتری
+CREATE TABLE IF NOT EXISTS "_CustomerGroupAssignees" (
+    "A" TEXT NOT NULL,
+    "B" TEXT NOT NULL
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS "_CustomerGroupAssignees_AB_unique" ON "_CustomerGroupAssignees"("A", "B");
+CREATE INDEX IF NOT EXISTS "_CustomerGroupAssignees_B_index" ON "_CustomerGroupAssignees"("B");
+
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint WHERE conname = '_CustomerGroupAssignees_A_fkey'
+  ) THEN
+    ALTER TABLE "_CustomerGroupAssignees"
+      ADD CONSTRAINT "_CustomerGroupAssignees_A_fkey"
+      FOREIGN KEY ("A") REFERENCES "CustomerGroup"("id")
+      ON DELETE CASCADE ON UPDATE CASCADE;
+  END IF;
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint WHERE conname = '_CustomerGroupAssignees_B_fkey'
+  ) THEN
+    ALTER TABLE "_CustomerGroupAssignees"
+      ADD CONSTRAINT "_CustomerGroupAssignees_B_fkey"
+      FOREIGN KEY ("B") REFERENCES "User"("id")
+      ON DELETE CASCADE ON UPDATE CASCADE;
+  END IF;
+END $$;

apps/api/prisma/schema.prisma

@@ -33,6 +33,17 @@ enum ActivityStatus {
   canceled
 }
 
+enum ActivityCompletionMode {
+  any
+  all
+}
+
+/// چه کسانی می‌توانند فعالیت را ویرایش/حذف کنند (علاوه بر owner/admin)
+enum ActivityEditPolicy {
+  creator
+  assignees
+}
+
 enum ActivityPriority {
   low
   medium
@@ -295,6 +306,8 @@ model User {
   ownedInvoices          Invoice[]                @relation("InvoiceOwner")
   ownedPeople            Person[]                 @relation("PersonOwner")
   ownedCompanies         Company[]                @relation("CompanyOwner")
+  assignedCustomerGroups CustomerGroup[]          @relation("CustomerGroupAssignees")
+  financialPartyDocuments FinancialDocument[]     @relation("FinancialDocumentParty")
   ownedProjectCards      ProjectCard[]            @relation("ProjectCardOwner")
   activities             Activity[]               @relation("ActivityAssignee")
   assignedActivities     Activity[]               @relation("ActivityAssignees")
@@ -353,6 +366,10 @@ model OrgRole {
   permissions    String[]     @default([])
   /// عمق داده به‌ازای بخش، مثلاً {"customers":{"mode":"rules","rules":[{"owners":["self"]}]}}
   dataAccessPolicy Json       @default("{}")
+  /// حساب‌های مالی اضافی این نقش؛ همراه با حساب‌هایی که خودش مسئول است
+  treasuryAccountIds String[] @default([])
+  /// اعضای نقش، حساب‌هایی را ببینند که نام خودشان مسئول آن است
+  treasuryOwnAccounts Boolean @default(false)
   /// owner | admin | sales | support — نقش‌های سیستمی قابل حذف نیستند
   systemKey      String?
   /// نقش والد برای سلسله‌مراتب زیرنقش‌ها
@@ -387,6 +404,8 @@ model Membership {
   dataVisibilityScopes Json         @default("{}")
   /// Override عمق داده نسبت به نقش؛ کلید غایب = ارث از OrgRole.dataAccessPolicy
   dataAccessOverride   Json         @default("{}")
+  /// null = دسترسی مالی از نقش؛ وگرنه جایگزین بخش‌ها و حساب‌های مالی همین کاربر
+  treasuryAccessOverride Json?
   /// سوئیچ «بایگانی اطلاعات قبل» برای این عضو؛ فقط وقتی ماژول محیط روشن است اثر دارد
   priorArchiveEnabled  Boolean      @default(false)
   /// current | archive
@@ -518,6 +537,7 @@ model Company {
   customFields       Json          @default("{}")
   groupLinks         CompanyGroupLink[]
   people             Person[]
+  financialDocuments FinancialDocument[]
   deals              Deal[]
   activities         Activity[]
   smartNotes         Note[]
@@ -557,6 +577,8 @@ model CustomerGroup {
   children            CustomerGroup[]    @relation("CustomerGroupTree")
   people              PersonGroupLink[]
   companies           CompanyGroupLink[]
+  /// مسئولان گروه — اختیاری؛ اعضای گروه را مثل مشتریان خود می‌بینند
+  assignees           User[]             @relation("CustomerGroupAssignees")
   createdAt           DateTime           @default(now())
   updatedAt           DateTime           @updatedAt
 
@@ -875,6 +897,12 @@ model Activity {
   /// زمان ارسال یادآور؛ با تغییر reminderAt پاک می‌شود
   reminderSentAt    DateTime?
   completedAt       DateTime?
+  /// any = با انجام یکی بسته می‌شود؛ all = هر مسئول باید سهم خودش را بزند
+  completionMode    ActivityCompletionMode @default(any)
+  /// مسئولانی که سهم خود را در حالت all ثبت کرده‌اند
+  completedByIds    String[]         @default([])
+  /// creator = فقط ایجادکننده؛ assignees = ایجادکننده + همهٔ مسئولان
+  editPolicy        ActivityEditPolicy @default(creator)
   tags              String[]         @default([])
   personId          String?
   person            Person?          @relation(fields: [personId], references: [id], onDelete: SetNull)
@@ -896,6 +924,8 @@ model Activity {
   /// مرحله (ستون کانبان)؛ null یا مرحلهٔ ناهم‌نوع با status → اولین مرحلهٔ هم‌نوع
   stageId           String?
   stage             ActivityStage?   @relation(fields: [stageId], references: [id], onDelete: SetNull)
+  /// ترتیب کارت داخل همان ستون کانبان
+  boardPosition     Int              @default(0)
   /// نوع سفارشی؛ null → نوع اصلیِ همان type
   typeDefId         String?
   typeDef           ActivityTypeDef? @relation(fields: [typeDefId], references: [id], onDelete: SetNull)
@@ -911,6 +941,7 @@ model Activity {
   updatedAt         DateTime         @updatedAt
 
   @@index([stageId])
+  @@index([stageId, boardPosition])
   @@index([boardId])
   @@index([typeDefId])
   @@index([leadId])
@@ -1832,6 +1863,13 @@ model AccountingConnection {
   lastHealthAt     DateTime?
   lastHealthOk     Boolean?
   lastError        String?
+  /// ساعت‌های بروزرسانی خودکار مشتریان (۰ تا ۲۳، وقت تهران). خالی یعنی خاموش.
+  customerSyncHours       Int[]     @default([])
+  /// نوبت claimشده، مثل 2026-11-05-08، تا در همان ساعت دو بار اجرا نشود
+  customerSyncLastSlot    String?
+  customerSyncLastRunAt   DateTime?
+  customerSyncLastSummary String?
+  customerSyncLastError   String?
   createdAt        DateTime                 @default(now())
   updatedAt        DateTime                 @updatedAt
   personLinks      PersonAccountingLink[]
@@ -2321,6 +2359,12 @@ model FinancialDocument {
   category       FinancialCategory?   @relation(fields: [categoryId], references: [id], onDelete: SetNull)
   personId       String?
   person         Person?              @relation(fields: [personId], references: [id], onDelete: SetNull)
+  companyId      String?
+  company        Company?             @relation(fields: [companyId], references: [id], onDelete: SetNull)
+  userId         String?
+  partyUser      User?                @relation("FinancialDocumentParty", fields: [userId], references: [id], onDelete: SetNull)
+  /// person | company | user | other
+  partyKind      String?
   partyName      String?
   accountId      String?
   account        FinancialAccount?    @relation("DocumentAccount", fields: [accountId], references: [id], onDelete: SetNull)
@@ -2341,6 +2385,8 @@ model FinancialDocument {
   @@index([organizationId, kind, bookedAt])
   @@index([organizationId, status])
   @@index([personId])
+  @@index([companyId])
+  @@index([userId])
 }
 
 /// گردش قطعی حساب. افتتاحیه، دریافت، پرداخت، انتقال.
@@ -2421,8 +2467,11 @@ model FinancialPayroll {
   period         String
   baseAmount     Decimal             @db.Decimal(18, 2)
   benefits       Decimal             @default(0) @db.Decimal(18, 2)
+  benefitsReason String?
   bonus          Decimal             @default(0) @db.Decimal(18, 2)
+  bonusReason    String?
   deductions     Decimal             @default(0) @db.Decimal(18, 2)
+  deductionsReason String?
   payable        Decimal             @db.Decimal(18, 2)
   dueDate        DateTime
   notes          String?
@@ -2927,18 +2976,28 @@ model MontifyWebhookDelivery {
   @@index([connectionId, createdAt])
 }
 
-/// اتصال تلفن سازمانی / سانترال (وب‌هوک عمومی)
+/// اتصال تلفن سازمانی / سانترال (وب‌هوک عمومی یا ارائه‌دهنده)
 model VoipConnection {
   id                      String        @id @default(cuid())
   organizationId          String
   organization            Organization  @relation(fields: [organizationId], references: [id], onDelete: Cascade)
   label                   String
+  /// generic | daftareshoma
+  provider                String        @default("generic")
   enabled                 Boolean       @default(true)
   webhookSecretCiphertext String?
   webhookSecretIv         String?
   webhookSecretTag        String?
-  /// قالب URL شروع تماس؛ جای {number} شماره می‌نشیند
+  /// قالب URL شروع تماس؛ جای {number} شماره می‌نشیند (generic)
   clickToCallUrl          String?
+  /// توکن Bearer API دفتر شما (رمزنگاری‌شده)
+  apiTokenCiphertext      String?
+  apiTokenIv              String?
+  apiTokenTag             String?
+  /// شماره مبدأ در تماس خروجی دفتر شما (from_number)
+  fromNumber              String?
+  /// خط/داخلی سازمان در دفتر شما (caller_extension)
+  callerExtension         String?
   lastEventAt             DateTime?
   lastError               String?
   calls                   VoipCallLog[]
@@ -2946,6 +3005,7 @@ model VoipConnection {
   updatedAt               DateTime      @updatedAt
 
   @@index([organizationId, enabled])
+  @@index([organizationId, provider])
 }
 
 model VoipCallLog {
@@ -2960,6 +3020,8 @@ model VoipCallLog {
   status               String         @default("completed")
   fromNumber           String?
   toNumber             String?
+  /// خط/داخلی سازمان که تماس روی آن بوده (مثلاً CalleeExtension دفتر شما)
+  lineExtension        String?
   personId             String?
   activityId           String?
   durationSec          Int?
@@ -2984,6 +3046,8 @@ model VoipCallLog {
 
   @@unique([connectionId, externalCallId])
   @@index([organizationId, syncedAt])
+  @@index([organizationId, lineExtension])
+  @@index([organizationId, status])
   @@index([personId])
   @@index([activityId])
   @@index([summaryStatus, summaryNextAttemptAt])
@@ -3760,3 +3824,9 @@ model AttendanceEvent {
   @@index([organizationId, userId, at])
   @@unique([organizationId, userId, kind, sessionStartedAt])
 }
+
+/// علامت یک‌بار اجرای اصلاح داده
+model DataFix {
+  key    String   @id
+  doneAt DateTime @default(now())
+}

apps/api/src/activities/activities-excel.service.ts

@@ -3,7 +3,7 @@ import type { ActivityType, ImportContactsResult } from '@mento/shared';
 import { PrismaService } from '../prisma/prisma.service';
 import type { Actor } from '../common/record-scope';
 import { assigneeWhere } from '../common/record-scope';
-import { normalizePhone } from '../contacts/normalize';
+import { phoneIdentityKeys, storedPhoneNumber } from '../contacts/normalize';
 import {
   excelFieldsFromColumns,
   formatClock,
@@ -357,7 +357,7 @@ export class ActivitiesExcelService {
       return id;
     };
     const resolvePerson = async (row: Record<string, string>) => {
-      const mobile = normalizePhone(row.personMobile);
+      const mobile = storedPhoneNumber(row.personMobile);
       const name = (row.personName ?? '').trim().toLowerCase();
       const key = mobile ? `m:${mobile}` : name ? `n:${name}` : '';
       if (!key) return null;
@@ -478,10 +478,13 @@ export class ActivitiesExcelService {
   }
 
   private async findPersonId(organizationId: string, row: Record<string, string>) {
-    const mobile = normalizePhone(row.personMobile);
-    if (mobile) {
+    const mobileKeys = phoneIdentityKeys(storedPhoneNumber(row.personMobile));
+    if (mobileKeys.length) {
       const byMobile = await this.prisma.person.findFirst({
-        where: { organizationId, mobile: { contains: mobile.replace(/^\+98|^98|^0/, '') } },
+        where: {
+          organizationId,
+          OR: [{ mobile: { in: mobileKeys } }, { phone: { in: mobileKeys } }],
+        },
         select: { id: true },
       });
       if (byMobile) return byMobile.id;

apps/api/src/activities/activities.controller.ts

@@ -428,12 +428,26 @@ export class ActivitiesController {
     @Param('id') id: string,
     @Body() dto: MoveActivityStageDto,
   ) {
-    return this.activitiesService.moveToStage(user.organizationId, id, user, dto.stageId);
+    return this.activitiesService.moveToStage(
+      user.organizationId,
+      id,
+      user,
+      dto.stageId,
+      dto.position,
+    );
   }
 
   @Patch(':id/complete')
-  complete(@CurrentUser() user: Actor, @Param('id') id: string) {
-    return this.activitiesService.complete(user.organizationId, id, user);
+  complete(
+    @CurrentUser() user: Actor,
+    @Param('id') id: string,
+    @Query('force') force?: string,
+    @Query('undo') undo?: string,
+  ) {
+    return this.activitiesService.complete(user.organizationId, id, user, {
+      force: force === '1' || force === 'true',
+      undo: undo === '1' || undo === 'true',
+    });
   }
 
   @Delete(':id')

apps/api/src/activities/activities.service.ts

@@ -31,6 +31,7 @@ import {
   ownerWhere,
 } from '../common/record-scope';
 import { assertAssigneeSet } from '../common/assign-access';
+import { placeId, sameIds, writePositions } from '../common/column-order';
 import { normalizeTags } from '../common/tags';
 import { GamificationService } from '../gamification/gamification.service';
 import { tehranDayKey } from '../routines/routine-dates';
@@ -51,6 +52,65 @@ type ActivityActor = Pick<
   'userId' | 'role' | 'priorLens' | 'priorCutoff' | 'leadsAccess' | 'teamPeerIds'
 >;
 
+function assigneeIdList(row: {
+  assigneeId?: string | null;
+  assignees?: Array<{ id: string }>;
+}): string[] {
+  const ids = row.assignees?.map((item) => item.id) ?? [];
+  if (ids.length) return [...new Set(ids)];
+  return row.assigneeId ? [row.assigneeId] : [];
+}
+
+function canForceClose(
+  actor: { userId: string; role: string },
+  createdById: string | null | undefined,
+): boolean {
+  return actor.role === 'owner' || actor.role === 'admin' || actor.userId === createdById;
+}
+
+function canMutateActivity(
+  actor: { userId: string; role: string },
+  row: {
+    createdById?: string | null;
+    editPolicy?: 'creator' | 'assignees' | null;
+    assigneeId?: string | null;
+    assignees?: Array<{ id: string }>;
+  },
+): boolean {
+  if (actor.role === 'owner' || actor.role === 'admin') return true;
+  if (row.createdById && actor.userId === row.createdById) return true;
+  if ((row.editPolicy ?? 'creator') !== 'assignees') return false;
+  return assigneeIdList(row).includes(actor.userId);
+}
+
+/** ثبت نظر / تعویق — برای همهٔ مسئولان، حتی وقتی ویرایش فقط با ایجادکننده است */
+function canCollaborateActivity(
+  actor: { userId: string; role: string },
+  row: {
+    createdById?: string | null;
+    assigneeId?: string | null;
+    assignees?: Array<{ id: string }>;
+  },
+): boolean {
+  if (actor.role === 'owner' || actor.role === 'admin') return true;
+  if (row.createdById && actor.userId === row.createdById) return true;
+  return assigneeIdList(row).includes(actor.userId);
+}
+
+/** فقط dueAt / description → تعویق و ثبت نظر */
+function isCollaboratorPatch(dto: UpdateActivityRequest): boolean {
+  const keys = Object.keys(dto).filter(
+    (key) => (dto as Record<string, unknown>)[key] !== undefined,
+  );
+  return keys.length > 0 && keys.every((key) => key === 'dueAt' || key === 'description');
+}
+
+function reconcileAllShares(assigneeIds: string[], completedByIds: string[]) {
+  const kept = [...new Set(completedByIds.filter((id) => assigneeIds.includes(id)))];
+  const done = assigneeIds.length > 0 && assigneeIds.every((id) => kept.includes(id));
+  return { status: done ? ('done' as const) : ('open' as const), completedByIds: kept };
+}
+
 /** stageId = شناسهٔ مرحله یا 'all'؛ وقتی ست باشد فیلتر زمانی وضعیت را تحمیل نمی‌کند (جز عقب‌افتاده) */
 type StageScope = { stageId: string };
 
@@ -81,6 +141,9 @@ type ActivityRow = {
   reminderNotifySms: boolean;
   reminderSentAt: Date | null;
   completedAt: Date | null;
+  completionMode?: 'any' | 'all';
+  completedByIds?: string[];
+  editPolicy?: 'creator' | 'assignees';
   importSource?: string;
   promotedFromPriorAt?: Date | null;
   tags: string[];
@@ -185,22 +248,39 @@ export class ActivitiesService {
     return { stages, types };
   }
 
+  /** کارهای بازِ «من» که سهم‌شان ثبت شده، از میز کار شخص خارج می‌شوند. */
+  private deskScope(
+    actor: ActivityActor,
+    desk?: 'mine' | 'team',
+  ): Prisma.ActivityWhereInput {
+    if (desk !== 'mine') return activityAccessWhere(actor);
+    return {
+      AND: [
+        {
+          OR: [
+            { assigneeId: actor.userId },
+            { assignees: { some: { id: actor.userId } } },
+            { participantIds: { has: actor.userId } },
+          ],
+        },
+        {
+          NOT: {
+            completionMode: 'all',
+            status: 'open',
+            completedByIds: { has: actor.userId },
+          },
+        },
+      ],
+    };
+  }
+
   async summary(
     organizationId: string,
     actor: ActivityActor,
     desk?: 'mine' | 'team',
   ): Promise<ActivitySummaryDto> {
     const { start, end } = dayBounds();
-    const scope: Prisma.ActivityWhereInput =
-      desk === 'mine'
-        ? {
-            OR: [
-              { assigneeId: actor.userId },
-              { assignees: { some: { id: actor.userId } } },
-              { participantIds: { has: actor.userId } },
-            ],
-          }
-        : activityAccessWhere(actor);
+    const scope = this.deskScope(actor, desk);
     const prior = activityPriorWhere(actor.priorLens, actor.priorCutoff);
     const [todayCount, overdueCount] = await Promise.all([
       this.prisma.activity.count({
@@ -329,9 +409,7 @@ export class ActivitiesService {
         where,
         include,
         // روی پروندهٔ لید، تازه‌ترین (از جمله پیگیری آینده) اول بیاید تا از سقف صفحه نیفتد
-        orderBy: entity?.leadId
-          ? [{ createdAt: 'desc' }]
-          : [{ dueAt: 'asc' }, { createdAt: 'desc' }],
+        orderBy: this.listOrder(entity, stageScope),
         skip: (page - 1) * take,
         take,
       }),
@@ -385,7 +463,7 @@ export class ActivitiesService {
       this.prisma.activity.findMany({
         where,
         select: { id: true },
-        orderBy: [{ dueAt: 'asc' }, { createdAt: 'desc' }],
+        orderBy: this.listOrder(entity, stageScope),
         take: cap,
       }),
       this.prisma.activity.count({ where }),
@@ -490,18 +568,69 @@ export class ActivitiesService {
     return { counts, total };
   }
 
+  private listOrder(
+    entity?: { leadId?: string },
+    stageScope?: StageScope,
+  ): Prisma.ActivityOrderByWithRelationInput[] {
+    if (entity?.leadId) return [{ createdAt: 'desc' }];
+    if (stageScope && stageScope.stageId !== 'all') {
+      return [{ boardPosition: 'asc' }, { dueAt: 'asc' }, { createdAt: 'desc' }];
+    }
+    return [{ dueAt: 'asc' }, { createdAt: 'desc' }];
+  }
+
+  private async reorderStage(
+    organizationId: string,
+    stageId: string,
+    activityId: string,
+    index: number,
+  ) {
+    const where = await this.stages.whereForStage(organizationId, stageId);
+    const rows = await this.prisma.activity.findMany({
+      where,
+      select: { id: true },
+      orderBy: [{ boardPosition: 'asc' }, { dueAt: 'asc' }, { createdAt: 'desc' }],
+    });
+    const currentIds = rows.map((row) => row.id);
+    const placed = placeId(currentIds, activityId, index);
+    if (sameIds(currentIds, placed)) return;
+    await writePositions(
+      (ops) => this.prisma.$transaction(ops),
+      placed,
+      (id, boardPosition) =>
+        this.prisma.activity.update({ where: { id }, data: { boardPosition } }),
+    );
+  }
+
   async moveToStage(
     organizationId: string,
     id: string,
     actor: ActivityActor,
     stageId: string,
+    position?: number,
   ): Promise<ActivityDto> {
     await this.ensureExists(organizationId, id, actor);
     const stage = await this.stages.get(organizationId, stageId);
     const existing = await this.prisma.activity.findFirst({
       where: { id, organizationId },
-      select: { status: true, completedAt: true },
+      select: {
+        status: true,
+        completedAt: true,
+        completionMode: true,
+        completedByIds: true,
+        createdById: true,
+        assigneeId: true,
+        assignees: { select: { id: true } },
+      },
     });
+    if (
+      stage.kind === 'done' &&
+      existing?.completionMode === 'all' &&
+      assigneeIdList(existing).length > 1 &&
+      !canForceClose(actor, existing.createdById)
+    ) {
+      return this.complete(organizationId, id, actor);
+    }
     const row = await this.prisma.activity.update({
       where: { id },
       data: {
@@ -516,9 +645,13 @@ export class ActivitiesService {
             : stage.kind === 'open'
               ? null
               : undefined,
+        ...(stage.kind === 'open' && existing?.status !== 'open'
+          ? { completedByIds: [] }
+          : {}),
       },
       include,
     });
+    if (position != null) await this.reorderStage(organizationId, stage.id, id, position);
     if (stage.kind === 'done' && existing?.status !== 'done') {
       await this.fireDone(organizationId, row);
     }
@@ -640,6 +773,9 @@ export class ActivitiesService {
         assignees: assigneeIds.length
           ? { connect: assigneeIds.map((id) => ({ id })) }
           : undefined,
+        completionMode: dto.completionMode === 'all' ? 'all' : 'any',
+        completedByIds: [],
+        editPolicy: dto.editPolicy === 'assignees' ? 'assignees' : 'creator',
         createdById: userId,
       },
       include,
@@ -708,8 +844,31 @@ export class ActivitiesService {
 
     const existing = await this.prisma.activity.findFirst({
       where: { id, organizationId },
-      select: { status: true, type: true, typeDefId: true, fields: true, participantIds: true },
+      select: {
+        status: true,
+        type: true,
+        typeDefId: true,
+        fields: true,
+        participantIds: true,
+        completionMode: true,
+        completedByIds: true,
+        editPolicy: true,
+        createdById: true,
+        assigneeId: true,
+        assignees: { select: { id: true } },
+      },
     });
+    if (!existing) {
+      throw new ForbiddenException('شما مجوز ویرایش این فعالیت را ندارید');
+    }
+    const collabOnly = isCollaboratorPatch(dto);
+    if (collabOnly) {
+      if (!canCollaborateActivity(actor, existing)) {
+        throw new ForbiddenException('شما مجوز ثبت نظر یا تعویق این فعالیت را ندارید');
+      }
+    } else if (!canMutateActivity(actor, existing)) {
+      throw new ForbiddenException('شما مجوز ویرایش این فعالیت را ندارید');
+    }
     const data: Prisma.ActivityUncheckedUpdateInput = {};
     if (dto.title !== undefined) data.title = dto.title.trim();
     if ('boardId' in dto) {
@@ -777,6 +936,7 @@ export class ActivitiesService {
     if ('dealId' in dto) data.dealId = emptyToNull(dto.dealId ?? null);
     if ('leadId' in dto) data.leadId = emptyToNull(dto.leadId ?? null);
     let assigneeConnect: Array<{ id: string }> | undefined;
+    let nextAssigneeIds: string[] | undefined;
     if (dto.assigneeIds !== undefined || 'assigneeId' in dto) {
       const current = await this.prisma.activity.findFirst({
         where: { id, organizationId },
@@ -804,6 +964,7 @@ export class ActivitiesService {
         );
         data.assigneeId = assigneeIds[0]!;
         assigneeConnect = assigneeIds.map((uid) => ({ id: uid }));
+        nextAssigneeIds = assigneeIds;
       } else {
         const assigneeId = emptyToNull(dto.assigneeId ?? null);
         if (assigneeId) await this.assertUserInOrg(organizationId, assigneeId);
@@ -817,12 +978,44 @@ export class ActivitiesService {
         data.assigneeId = assigneeId;
         if (assigneeId) assigneeConnect = [{ id: assigneeId }];
         else assigneeConnect = [];
+        nextAssigneeIds = assigneeId ? [assigneeId] : [];
       }
     }
-    if (dto.status !== undefined) {
-      data.status = dto.status;
-      data.completedAt =
-        dto.status === 'done' ? new Date() : dto.status === 'open' ? null : undefined;
+    const modeChanged = dto.completionMode === 'any' || dto.completionMode === 'all';
+    const nextMode = modeChanged ? dto.completionMode! : (existing?.completionMode ?? 'any');
+    if (modeChanged) data.completionMode = nextMode;
+    if (dto.editPolicy === 'creator' || dto.editPolicy === 'assignees') {
+      data.editPolicy = dto.editPolicy;
+    }
+    const prevAssigneeIds = assigneeIdList(existing ?? {});
+    const nextIds = nextAssigneeIds ?? prevAssigneeIds;
+    const explicitDone = dto.status === 'done';
+    const explicitReopen = dto.status === 'open' && existing?.status !== 'open';
+    const explicitCancel = dto.status === 'canceled';
+    if (explicitDone) {
+      data.status = 'done';
+      data.completedAt = new Date();
+    } else if (explicitReopen) {
+      data.status = 'open';
+      data.completedAt = null;
+      data.completedByIds = [];
+    } else if (explicitCancel) {
+      data.status = 'canceled';
+    } else if (nextMode === 'any' && modeChanged) {
+      data.completedByIds = [];
+    } else if (nextMode === 'all' && (modeChanged || nextAssigneeIds)) {
+      const reconciled = reconcileAllShares(nextIds, existing?.completedByIds ?? []);
+      data.completedByIds = reconciled.completedByIds;
+      const finishedStaysFinished = existing?.status === 'done' && !nextAssigneeIds;
+      if (existing?.status !== 'canceled' && !finishedStaysFinished) {
+        if (reconciled.status === 'done' && existing?.status !== 'done') {
+          data.status = 'done';
+          data.completedAt = new Date();
+        } else if (reconciled.status === 'open' && existing?.status === 'done') {
+          data.status = 'open';
+          data.completedAt = null;
+        }
+      }
     }
 
     const row = await this.prisma.activity.update({
@@ -846,7 +1039,7 @@ export class ActivitiesService {
         addedParticipants.filter((uid) => !assigneeSet.has(uid)),
       );
     }
-    if (dto.status === 'done' && existing?.status !== 'done') {
+    if (data.status === 'done' && existing?.status !== 'done') {
       await this.fireDone(organizationId, row);
     }
     return this.toDto(row, await this.ctx(organizationId));
@@ -856,18 +1049,74 @@ export class ActivitiesService {
     organizationId: string,
     id: string,
     actor: ActivityActor,
+    options: { force?: boolean; undo?: boolean } = {},
   ): Promise<ActivityDto> {
     await this.ensureExists(organizationId, id, actor);
     const existing = await this.prisma.activity.findFirst({
       where: { id, organizationId },
-      select: { status: true },
+      select: {
+        status: true,
+        completionMode: true,
+        completedByIds: true,
+        createdById: true,
+        assigneeId: true,
+        assignees: { select: { id: true } },
+      },
     });
+    if (!existing) throw new NotFoundException('فعالیت پیدا نشد');
+    if (existing.status === 'canceled') {
+      throw new BadRequestException('فعالیت لغو شده است');
+    }
+
+    const assignees = assigneeIdList(existing);
+    const allowedForce = canForceClose(actor, existing.createdById);
+    if (options.force && !allowedForce) {
+      throw new ForbiddenException('بستن فعالیت برای همه فقط برای سازنده یا مدیر ممکن است');
+    }
+
+    if (options.undo) {
+      if (existing.completionMode !== 'all' || existing.status !== 'open') {
+        throw new BadRequestException('سهم انجام‌شده را فقط تا وقتی فعالیت باز است می‌توان لغو کرد');
+      }
+      const row = await this.prisma.activity.update({
+        where: { id },
+        data: {
+          completedByIds: existing.completedByIds.filter((uid) => uid !== actor.userId),
+        },
+        include,
+      });
+      return this.toDto(row, await this.ctx(organizationId));
+    }
+
+    const personal =
+      existing.completionMode === 'all' && assignees.length > 1 && !options.force;
+    if (!personal) {
+      const row = await this.prisma.activity.update({
+        where: { id },
+        data: { status: 'done', completedAt: new Date() },
+        include,
+      });
+      if (existing.status !== 'done') await this.fireDone(organizationId, row);
+      return this.toDto(row, await this.ctx(organizationId));
+    }
+
+    if (!assignees.includes(actor.userId)) {
+      throw new ForbiddenException('فقط مسئول این فعالیت می‌تواند سهم خودش را ثبت کند');
+    }
+    const reconciled = reconcileAllShares(assignees, [
+      ...existing.completedByIds,
+      actor.userId,
+    ]);
     const row = await this.prisma.activity.update({
       where: { id },
-      data: { status: 'done', completedAt: new Date() },
+      data: {
+        completedByIds: reconciled.completedByIds,
+        status: reconciled.status,
+        completedAt: reconciled.status === 'done' ? new Date() : null,
+      },
       include,
     });
-    if (existing?.status !== 'done') {
+    if (reconciled.status === 'done' && existing.status !== 'done') {
       await this.fireDone(organizationId, row);
     }
     return this.toDto(row, await this.ctx(organizationId));
@@ -911,6 +1160,18 @@ export class ActivitiesService {
     actor: ActivityActor,
   ): Promise<void> {
     await this.ensureExists(organizationId, id, actor);
+    const existing = await this.prisma.activity.findFirst({
+      where: { id, organizationId },
+      select: {
+        createdById: true,
+        editPolicy: true,
+        assigneeId: true,
+        assignees: { select: { id: true } },
+      },
+    });
+    if (!existing || !canMutateActivity(actor, existing)) {
+      throw new ForbiddenException('شما مجوز حذف این فعالیت را ندارید');
+    }
     const images = await this.prisma.activityImage.findMany({
       where: { activityId: id, organizationId },
       select: { storageKey: true, sizeBytes: true },
@@ -931,6 +1192,19 @@ export class ActivitiesService {
     actor: ActivityActor,
   ): Promise<ActivityImageDto> {
     await this.ensureExists(organizationId, activityId, actor);
+    const gate = await this.prisma.activity.findFirst({
+      where: { id: activityId, organizationId },
+      select: {
+        createdById: true,
+        editPolicy: true,
+        assigneeId: true,
+        assignees: { select: { id: true } },
+      },
+    });
+    // پیوست در مسیر ثبت نظر — مسئولان هم مجازند حتی با editPolicy=creator
+    if (!gate || !canCollaborateActivity(actor, gate)) {
+      throw new ForbiddenException('شما مجوز ثبت نظر یا پیوست برای این فعالیت را ندارید');
+    }
     if (!file?.buffer?.length) {
       throw new BadRequestException('فایلی ارسال نشده است');
     }
@@ -1025,10 +1299,27 @@ export class ActivitiesService {
     actor: ActivityActor,
   ): Promise<void> {
     await this.ensureExists(organizationId, activityId, actor);
+    const gate = await this.prisma.activity.findFirst({
+      where: { id: activityId, organizationId },
+      select: {
+        createdById: true,
+        editPolicy: true,
+        assigneeId: true,
+        assignees: { select: { id: true } },
+      },
+    });
     const row = await this.prisma.activityImage.findFirst({
       where: { id: imageId, activityId, organizationId },
     });
     if (!row) throw new NotFoundException('فایل پیدا نشد');
+    const canMutate = !!gate && canMutateActivity(actor, gate);
+    const canRemoveOwn =
+      !!gate &&
+      canCollaborateActivity(actor, gate) &&
+      row.uploadedById === actor.userId;
+    if (!canMutate && !canRemoveOwn) {
+      throw new ForbiddenException('شما مجوز حذف این پیوست را ندارید');
+    }
     await this.files.remove(row.storageKey);
     await this.prisma.activityImage.delete({ where: { id: row.id } });
     await this.storage.addLocal(organizationId, -row.sizeBytes);
@@ -1073,16 +1364,7 @@ export class ActivitiesService {
     typeRows: TypeRow[] = [],
   ): Prisma.ActivityWhereInput {
     const { start, end } = dayBounds();
-    const scope: Prisma.ActivityWhereInput =
-      desk === 'mine'
-        ? {
-            OR: [
-              { assigneeId: actor.userId },
-              { assignees: { some: { id: actor.userId } } },
-              { participantIds: { has: actor.userId } },
-            ],
-          }
-        : activityAccessWhere(actor);
+    const scope = this.deskScope(actor, desk);
     const facetAssignee = facets?.assigneeId?.trim();
     const facetTypeDef = facets?.typeDefId?.trim();
     const facetTitle = facets?.title?.trim();
@@ -1383,6 +1665,9 @@ export class ActivitiesService {
       reminderNotifySms: row.reminderNotifySms,
       reminderSentAt: row.reminderSentAt?.toISOString() ?? null,
       completedAt: row.completedAt?.toISOString() ?? null,
+      completionMode: row.completionMode ?? 'any',
+      completedByIds: row.completedByIds ?? [],
+      editPolicy: row.editPolicy ?? 'creator',
       importSource: row.importSource ?? 'manual',
       promotedFromPriorAt: row.promotedFromPriorAt?.toISOString() ?? null,
       tags: row.tags ?? [],

apps/api/src/activities/dto.ts

@@ -219,6 +219,12 @@ export class ReorderActivityStagesDto {
 export class MoveActivityStageDto {
   @IsString()
   stageId!: string;
+
+  @IsOptional()
+  @Type(() => Number)
+  @IsInt()
+  @Min(0)
+  position?: number;
 }
 
 /** محتوای fields در سرویس بر اساس تعریف نوع اعتبارسنجی می‌شود */
@@ -316,7 +322,7 @@ export class CreateActivityDto {
 
   @IsOptional()
   @IsString()
-  @MaxLength(2000)
+  @MaxLength(20000)
   description?: string;
 
   @IsOptional()
@@ -378,6 +384,14 @@ export class CreateActivityDto {
   @IsArray()
   @IsString({ each: true })
   assigneeIds?: string[];
+
+  @IsOptional()
+  @IsIn(['any', 'all'])
+  completionMode?: 'any' | 'all';
+
+  @IsOptional()
+  @IsIn(['creator', 'assignees'])
+  editPolicy?: 'creator' | 'assignees';
 }
 
 export class UpdateActivityDto {
@@ -416,7 +430,7 @@ export class UpdateActivityDto {
 
   @IsOptional()
   @IsString()
-  @MaxLength(2000)
+  @MaxLength(20000)
   description?: string | null;
 
   @IsOptional()
@@ -478,4 +492,12 @@ export class UpdateActivityDto {
   @IsArray()
   @IsString({ each: true })
   assigneeIds?: string[];
+
+  @IsOptional()
+  @IsIn(['any', 'all'])
+  completionMode?: 'any' | 'all';
+
+  @IsOptional()
+  @IsIn(['creator', 'assignees'])
+  editPolicy?: 'creator' | 'assignees';
 }

apps/api/src/auth/auth.service.ts

@@ -19,6 +19,10 @@ import type {
   StorageUsageDto,
   SubscriptionSummaryDto,
 } from '@mento/shared';
+import {
+  parseUserTreasuryAccess,
+  permissionsWithTreasuryOverride,
+} from '@mento/shared';
 import { Prisma } from '@prisma/client';
 /** Ensures Express.Multer.File augmentation is loaded for saveAvatar. */
 import type {} from 'multer';
@@ -848,6 +852,9 @@ export class AuthService {
       },
     });
     const role = membership?.role ?? user.role;
+    const rolePermissions = Array.isArray(membership?.orgRole?.permissions)
+      ? membership.orgRole.permissions.filter((item) => typeof item === 'string')
+      : [];
     const orgName = membership?.organization.name;
     const sub =
       subscription ??
@@ -879,9 +886,10 @@ export class AuthService {
       storage,
       isOrgOwner: role === 'owner',
       priorArchive: this.priorArchiveFor(membership),
-      permissions: (Array.isArray(membership?.orgRole?.permissions)
-        ? membership.orgRole.permissions.filter((item) => typeof item === 'string')
-        : []) as AuthUserDto['permissions'],
+      permissions: permissionsWithTreasuryOverride(
+        rolePermissions,
+        parseUserTreasuryAccess(membership?.treasuryAccessOverride),
+      ) as AuthUserDto['permissions'],
       ...(viewAs ? { viewAs } : {}),
     });
   }

apps/api/src/auth/jwt.strategy.ts

@@ -195,6 +195,10 @@ export class JwtStrategy extends PassportStrategy(Strategy) {
     const peers = await this.prisma.teamMember.findMany({
       where: {
         teamId: { in: memberships.map((m) => m.teamId) },
+        team: { organizationId },
+        user: {
+          memberships: { some: { organizationId, isActive: true } },
+        },
       },
       select: { userId: true },
     });

apps/api/src/billing/billing.service.ts

@@ -21,6 +21,9 @@ import {
   defaultEnabledModules,
   isPermanentBillingPlan,
   isOrgModuleKey,
+  modulesForProductPlan,
+  PRODUCT_PLAN_LIMITS,
+  type ProductPlanCode,
 } from '@mento/shared';
 import { PrismaService } from '../prisma/prisma.service';
 import { PlatformAdminAlertService } from './platform-admin-alert.service';
@@ -414,7 +417,37 @@ export class BillingService {
   }
 
   defaultModulesForNewOrg(): OrgModuleKey[] {
-    return defaultEnabledModules();
+    return modulesForProductPlan('core');
+  }
+
+  /** سطح امکانات را روی همهٔ محیط‌های مالک می‌گذارد و سقف هسته/تیم/سازمان را هم تنظیم می‌کند. */
+  async applyProductPlan(organizationId: string, code: ProductPlanCode) {
+    const modules = modulesForProductPlan(code);
+    const owner = await this.prisma.membership.findFirst({
+      where: { organizationId, role: 'owner', isActive: true },
+      orderBy: { createdAt: 'asc' },
+      select: { userId: true },
+    });
+    const orgIds = owner ? await this.ownedOrganizationIds(owner.userId) : [organizationId];
+    for (const id of orgIds) {
+      await this.setOrgModules(id, modules);
+    }
+    const limits = PRODUCT_PLAN_LIMITS[code];
+    if (owner && (limits.maxUsers != null || limits.maxOrganizations != null)) {
+      const account = await this.getByOwnerUserId(owner.userId);
+      if (account) {
+        await this.prisma.billingAccount.update({
+          where: { id: account.id },
+          data: {
+            ...(limits.maxUsers != null ? { maxUsers: limits.maxUsers } : {}),
+            ...(limits.maxOrganizations != null
+              ? { maxOrganizations: limits.maxOrganizations }
+              : {}),
+          },
+        });
+      }
+    }
+    return modules;
   }
 
   async countExpiringSoon() {

apps/api/src/common/column-order.ts

@@ -0,0 +1,28 @@
+import type { Prisma } from '@prisma/client';
+
+type PositionUpdate = Prisma.PrismaPromise<unknown>;
+
+/** کارت را در ایندکس خواسته‌شده می‌گذارد. ایندکس نسبت به فهرست بدون خود کارت است. */
+export function placeId(ids: string[], movingId: string, index: number): string[] {
+  const next = ids.filter((id) => id !== movingId);
+  const at = Math.max(0, Math.min(Math.trunc(index), next.length));
+  next.splice(at, 0, movingId);
+  return next;
+}
+
+export function sameIds(left: string[], right: string[]): boolean {
+  return left.length === right.length && left.every((id, index) => id === right[index]);
+}
+
+/** ترتیب ستون را ۰ تا n ذخیره می‌کند. */
+export async function writePositions(
+  transaction: (ops: PositionUpdate[]) => Promise<unknown>,
+  ids: string[],
+  update: (id: string, position: number) => PositionUpdate,
+) {
+  const size = 60;
+  for (let start = 0; start < ids.length; start += size) {
+    const slice = ids.slice(start, start + size);
+    await transaction(slice.map((id, offset) => update(id, start + offset)));
+  }
+}

apps/api/src/common/data-access.ts

@@ -115,9 +115,7 @@ export function buildContactRuleWhere(
     if (!ids.length) return null;
     and.push(ids.length === 1 ? { ownerId: ids[0]! } : { ownerId: { in: ids } });
   }
-  if (rule.groupIds?.length) {
-    and.push({ groupLinks: { some: { groupId: { in: rule.groupIds } } } });
-  }
+  // groupIds دیگر فیلتر دسترسی نیست؛ دید گروه فقط از مسئول‌گروه (personViaGroupAssignee)
   if (rule.sources?.length) {
     and.push({
       OR: [{ importSource: { in: rule.sources } }, { sourceRef: { in: rule.sources } }],
@@ -135,6 +133,23 @@ function orParts<T>(parts: T[]): T | { OR: T[] } | { id: string } {
   return parts.length === 1 ? parts[0]! : { OR: parts };
 }
 
+/** اعضای گروه‌هایی که کاربر مسئولشان است */
+function personViaGroupAssignee(userId: string): Prisma.PersonWhereInput {
+  return {
+    groupLinks: {
+      some: { group: { assignees: { some: { id: userId } } } },
+    },
+  };
+}
+
+function companyViaGroupAssignee(userId: string): Prisma.CompanyWhereInput {
+  return {
+    groupLinks: {
+      some: { group: { assignees: { some: { id: userId } } } },
+    },
+  };
+}
+
 export function customersPersonWhere(
   actor: Pick<Actor, 'userId' | 'role' | 'customersAccess' | 'teamPeerIds'>,
 ): Prisma.PersonWhereInput {
@@ -149,6 +164,8 @@ export function customersPersonWhere(
     });
     if (w) parts.push(w);
   }
+  // مسئول گروه: اتحاد با محدودیت نقش (مالک خودم یا عضو گروه تحت مسئولیت)
+  parts.push(personViaGroupAssignee(actor.userId));
   return orParts(parts);
 }
 
@@ -169,25 +186,19 @@ export function customersCompanyWhere(
       if (!ids.length) continue;
       and.push(ids.length === 1 ? { ownerId: ids[0]! } : { ownerId: { in: ids } });
     }
-    if (rule.groupIds?.length) {
-      and.push({ groupLinks: { some: { groupId: { in: rule.groupIds } } } });
-    }
+    // groupIds دیگر فیلتر دسترسی نیست؛ دید گروه فقط از مسئول‌گروه (companyViaGroupAssignee)
     if (rule.sources?.length) {
       and.push({
         OR: [{ importSource: { in: rule.sources } }, { sourceRef: { in: rule.sources } }],
       });
     }
-    if (
-      rule.moods?.length &&
-      !rule.owners?.length &&
-      !rule.groupIds?.length &&
-      !rule.sources?.length
-    ) {
+    if (rule.moods?.length && !rule.owners?.length && !rule.sources?.length) {
       continue;
     }
     if (!and.length) continue;
     parts.push(and.length === 1 ? and[0]! : { AND: and });
   }
+  parts.push(companyViaGroupAssignee(actor.userId));
   return orParts(parts);
 }
 
@@ -449,9 +460,14 @@ export function sectionOwnerIdUnion(
     if (rule.owners?.length) {
       sawOwnerRule = true;
       for (const id of ownerIdList(rule, ctx)) ids.add(id);
-    } else if (rule.groupIds?.length || rule.sources?.length || rule.moods?.length ||
-      rule.stageIds?.length || rule.pipelineIds?.length || rule.boardIds?.length ||
-      rule.typeIds?.length) {
+    } else if (
+      rule.sources?.length ||
+      rule.moods?.length ||
+      rule.stageIds?.length ||
+      rule.pipelineIds?.length ||
+      rule.boardIds?.length ||
+      rule.typeIds?.length
+    ) {
       sawNonOwnerRule = true;
     }
   }

apps/api/src/common/record-scope.ts

@@ -5,7 +5,7 @@ import type {
   SectionDataAccess,
   UserRole,
 } from '@mento/shared';
-import { DATA_SCOPES, canViewAllRecords } from '@mento/shared';
+import { DATA_SCOPES, canViewAllRecords, sectionHasDataAccessLimits } from '@mento/shared';
 import type { Prisma } from '@prisma/client';
 import {
   activitiesDeepWhere,
@@ -13,6 +13,7 @@ import {
   notesDeepWhere,
   projectsDeepWhere,
   routinesDeepWhere,
+  sectionOwnerIdUnion,
   ticketsDeepWhere,
 } from './data-access';
 
@@ -60,6 +61,65 @@ export type Actor = {
 
 export type ScopedActor = Pick<Actor, 'userId' | 'role' | 'dataVisibility' | 'visibleUserIds' | 'scopes'>;
 
+type DeepAccessActor = ScopedActor &
+  Partial<
+    Pick<
+      Actor,
+      | 'customersAccess'
+      | 'leadsAccess'
+      | 'salesAccess'
+      | 'activitiesAccess'
+      | 'notesAccess'
+      | 'routinesAccess'
+      | 'projectsAccess'
+      | 'ticketsAccess'
+      | 'teamPeerIds'
+    >
+  >;
+
+function sectionForScope(actor: DeepAccessActor, scope: DataScope): SectionDataAccess | undefined {
+  switch (scope) {
+    case 'contacts':
+      return actor.customersAccess;
+    case 'leads':
+      return actor.leadsAccess;
+    case 'deals':
+      return actor.salesAccess;
+    case 'activities':
+      return actor.activitiesAccess;
+    case 'notes':
+      return actor.notesAccess;
+    case 'routines':
+      return actor.routinesAccess;
+    case 'projects':
+      return actor.projectsAccess;
+    case 'tickets':
+      return actor.ticketsAccess;
+    default:
+      return undefined;
+  }
+}
+
+/**
+ * شناسه‌های مالک از قانون عمق داده.
+ * legacy = بخش عمیق روی این Actor نیست.
+ * open = محدودیت مالکی ندارد (همه، یا فقط فیلترهای غیرمالک).
+ */
+function deepOwnerIds(
+  actor: DeepAccessActor,
+  scope: DataScope,
+): { kind: 'legacy' } | { kind: 'open' } | { kind: 'ids'; ids: string[] } {
+  const section = sectionForScope(actor, scope);
+  if (!section) return { kind: 'legacy' };
+  if (!sectionHasDataAccessLimits(section)) return { kind: 'open' };
+  const ids = sectionOwnerIdUnion(section, {
+    userId: actor.userId,
+    teamPeerIds: actor.teamPeerIds ?? null,
+  });
+  if (ids === null) return { kind: 'open' };
+  return { kind: 'ids', ids };
+}
+
 /** Actor با سطح دید مخصوص یک بخش (اگر تنظیم شده باشد). */
 export function forScope<T extends ScopedActor>(actor: T, scope: DataScope): T {
   const s = actor.scopes?.[scope];
@@ -109,9 +169,16 @@ export function scopedOwnerIds(
 
 /** فیلتر مالکیت؛ پیش‌فرض بخش «مشتریان» (Person / Company). برای فاکتور/پیش‌فاکتور scope=finance. */
 export function ownerWhere(
-  actor: ScopedActor,
+  actor: DeepAccessActor,
   scope: DataScope = 'contacts',
 ): { ownerId: string } | { ownerId: { in: string[] } } | Record<string, never> {
+  const deep = deepOwnerIds(actor, scope);
+  if (deep.kind === 'open') return {};
+  if (deep.kind === 'ids') {
+    if (deep.ids.length === 1) return { ownerId: deep.ids[0]! };
+    if (!deep.ids.length) return { ownerId: '__no_access__' };
+    return { ownerId: { in: deep.ids } };
+  }
   const ids = scopedOwnerIds(actor, scope);
   if (!ids) return {};
   if (ids.length === 1) return { ownerId: ids[0]! };
@@ -153,11 +220,16 @@ export function projectCardAccessWhere(
 }
 
 /** فعالیت‌ها بر اساس مسئول اصلی یا مسئولان مشترک */
-export function assigneeWhere(
-  actor: ScopedActor,
-): Prisma.ActivityWhereInput {
-  const ids = scopedOwnerIds(actor, 'activities');
+export function assigneeWhere(actor: DeepAccessActor): Prisma.ActivityWhereInput {
+  const deep = deepOwnerIds(actor, 'activities');
+  const ids =
+    deep.kind === 'open'
+      ? null
+      : deep.kind === 'ids'
+        ? deep.ids
+        : scopedOwnerIds(actor, 'activities');
   if (!ids) return {};
+  if (!ids.length) return { assigneeId: '__no_access__' };
   return {
     OR: [
       { assigneeId: { in: ids } },

apps/api/src/contacts/birthday-month.ts

@@ -60,6 +60,7 @@ export function selectMonthBirthdays(people: BirthdayRow[], now = new Date(), pr
   const upcoming = matched.filter((row) => row.day >= today.jd).sort(byDay);
   const passed = matched.filter((row) => row.day < today.jd).sort(byDay);
   return {
+    year: today.jy,
     month: today.jm,
     monthName: jalaliMonthName(today.jm),
     today: today.jd,

apps/api/src/contacts/companies.service.ts

@@ -112,9 +112,13 @@ export class CompaniesService {
       ...(groupIds.length ? [{ groupLinks: { some: { groupId: { in: groupIds } } } }] : []),
     ];
     const where: Prisma.CompanyWhereInput = {
-      organizationId: actor.organizationId,
-      ...customersCompanyWhere(actor),
-      ...(and.length ? { AND: and } : {}),
+      AND: [
+        {
+          organizationId: actor.organizationId,
+          ...customersCompanyWhere(actor),
+        },
+        ...and,
+      ],
     };
 
     const [rows, total] = await this.prisma.$transaction([
@@ -165,6 +169,7 @@ export class CompaniesService {
       fromTahesab: Boolean(g.tahesabGid),
       personCount: 0,
       companyCount: countMap.get(g.id) ?? 0,
+      assignees: [],
     }));
   }
 

apps/api/src/contacts/contacts.module.ts

@@ -3,11 +3,13 @@ import { LoyaltyModule } from '../loyalty/loyalty.module';
 import { AutomationsModule } from '../automations/automations.module';
 import { MessageAutomationsModule } from '../message-automations/message-automations.module';
 import { PublicApiModule } from '../public-api/public-api.module';
+import { NotificationsModule } from '../notifications/notifications.module';
 import { CompaniesController } from './companies.controller';
 import { CompaniesService } from './companies.service';
 import { PeopleController } from './people.controller';
 import { PeopleService } from './people.service';
 import { ContactsExcelService } from './contacts-excel.service';
+import { SameMobileMergeService } from './same-mobile-merge.service';
 import { BehaviorModule } from '../behavior/behavior.module';
 import { CustomerGroupsModule } from '../customer-groups/customer-groups.module';
 
@@ -19,9 +21,10 @@ import { CustomerGroupsModule } from '../customer-groups/customer-groups.module'
     PublicApiModule,
     BehaviorModule,
     CustomerGroupsModule,
+    NotificationsModule,
   ],
   controllers: [PeopleController, CompaniesController],
-  providers: [PeopleService, CompaniesService, ContactsExcelService],
+  providers: [PeopleService, CompaniesService, ContactsExcelService, SameMobileMergeService],
   exports: [PeopleService, CompaniesService],
 })
 export class ContactsModule {}

apps/api/src/contacts/dto.ts

@@ -23,6 +23,11 @@ export class BirthdaySmsDto {
   @MinLength(1)
   @MaxLength(500)
   text!: string;
+
+  /** تأیید ارسال مجدد وقتی قبلاً مسئول دیگری تبریک فرستاده */
+  @IsOptional()
+  @IsBoolean()
+  force?: boolean;
 }
 
 export class BulkDeletePeopleDto {

apps/api/src/contacts/merge-same-mobile.ts

@@ -0,0 +1,367 @@
+import { readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { Prisma, PrismaClient } from '@prisma/client';
+import { canonicalIranMobile, storedPhoneNumber } from './normalize';
+
+const personSelect = {
+  id: true,
+  createdAt: true,
+  firstName: true,
+  lastName: true,
+  gender: true,
+  showGenderInName: true,
+  previousFirstName: true,
+  previousLastName: true,
+  email: true,
+  phone: true,
+  mobile: true,
+  position: true,
+  website: true,
+  instagram: true,
+  birthDate: true,
+  referrer: true,
+  addresses: true,
+  notes: true,
+  tags: true,
+  companyId: true,
+  customFields: true,
+  importSource: true,
+  sourceRef: true,
+  previousImportSource: true,
+  previousSourceRef: true,
+  loyaltyPoints: true,
+  discLabel: true,
+  discReliable: true,
+  discAssessedAt: true,
+} satisfies Prisma.PersonSelect;
+
+type PersonRow = Prisma.PersonGetPayload<{ select: typeof personSelect }>;
+
+function blank(value: string | null | undefined) {
+  return !value?.trim();
+}
+
+function asStrings(value: Prisma.JsonValue): string[] {
+  if (!Array.isArray(value)) return [];
+  return value.map((item) => String(item)).filter(Boolean);
+}
+
+function asObject(value: Prisma.JsonValue): Record<string, unknown> {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return {};
+  return { ...(value as Record<string, unknown>) };
+}
+
+function mergedFields(keeper: PersonRow, extras: PersonRow[], canon: string): Prisma.PersonUncheckedUpdateInput {
+  const notes = [keeper.notes?.trim() || ''];
+  let email = keeper.email;
+  let phone = storedPhoneNumber(keeper.phone);
+  let position = keeper.position;
+  let website = keeper.website;
+  let instagram = keeper.instagram;
+  let birthDate = keeper.birthDate;
+  let referrer = keeper.referrer;
+  let companyId = keeper.companyId;
+  let gender = keeper.gender;
+  let showGenderInName = keeper.showGenderInName;
+  let previousFirstName = keeper.previousFirstName;
+  let previousLastName = keeper.previousLastName;
+  let previousImportSource = keeper.previousImportSource;
+  let previousSourceRef = keeper.previousSourceRef;
+  let discLabel = keeper.discLabel;
+  let discReliable = keeper.discReliable;
+  let discAssessedAt = keeper.discAssessedAt;
+  let loyaltyPoints = keeper.loyaltyPoints;
+  const addresses = asStrings(keeper.addresses);
+  const tags = new Set(keeper.tags);
+  const customFields = asObject(keeper.customFields);
+
+  for (const extra of extras) {
+    const name = `${extra.firstName} ${extra.lastName}`.trim();
+    notes.push(
+      `ادغام شماره تکراری: ${name || 'بدون نام'} (${extra.mobile || 'بدون موبایل'})`,
+    );
+    if (blank(email) && extra.email) email = extra.email;
+    if (blank(phone)) phone = storedPhoneNumber(extra.phone);
+    if (blank(position) && extra.position) position = extra.position;
+    if (blank(website) && extra.website) website = extra.website;
+    if (blank(instagram) && extra.instagram) instagram = extra.instagram;
+    if (!birthDate && extra.birthDate) birthDate = extra.birthDate;
+    if (blank(referrer) && extra.referrer) referrer = extra.referrer;
+    if (!companyId && extra.companyId) companyId = extra.companyId;
+    if (gender === 'none' && extra.gender !== 'none') {
+      gender = extra.gender;
+      showGenderInName = extra.showGenderInName;
+    }
+    if (blank(previousFirstName) && extra.previousFirstName) {
+      previousFirstName = extra.previousFirstName;
+    }
+    if (blank(previousLastName) && extra.previousLastName) {
+      previousLastName = extra.previousLastName;
+    }
+    if (
+      blank(previousImportSource) &&
+      extra.importSource &&
+      extra.importSource !== keeper.importSource
+    ) {
+      previousImportSource = extra.importSource;
+      previousSourceRef = extra.sourceRef;
+    }
+    if (
+      keeper.importSource === 'tahesab' &&
+      blank(previousFirstName) &&
+      blank(previousLastName)
+    ) {
+      const extraName = `${extra.firstName} ${extra.lastName}`.trim();
+      const keeperName = `${keeper.firstName} ${keeper.lastName}`.trim();
+      if (extraName && extraName !== keeperName) {
+        previousFirstName = extra.firstName || null;
+        previousLastName = extra.lastName || null;
+      }
+    }
+    if (!discLabel && extra.discLabel) {
+      discLabel = extra.discLabel;
+      discReliable = extra.discReliable;
+      discAssessedAt = extra.discAssessedAt;
+    }
+    loyaltyPoints = Math.max(loyaltyPoints, extra.loyaltyPoints);
+    for (const address of asStrings(extra.addresses)) {
+      if (!addresses.includes(address)) addresses.push(address);
+    }
+    for (const tag of extra.tags) tags.add(tag);
+    for (const [key, value] of Object.entries(asObject(extra.customFields))) {
+      if (customFields[key] == null || customFields[key] === '') customFields[key] = value;
+    }
+  }
+
+  return {
+    mobile: canon,
+    email,
+    phone,
+    position,
+    website,
+    instagram,
+    birthDate,
+    referrer,
+    companyId,
+    gender,
+    showGenderInName,
+    previousFirstName,
+    previousLastName,
+    previousImportSource,
+    previousSourceRef,
+    discLabel,
+    discReliable,
+    discAssessedAt,
+    loyaltyPoints,
+    addresses,
+    tags: [...tags],
+    customFields: customFields as Prisma.InputJsonValue,
+    notes: notes.filter(Boolean).join('\n') || null,
+  };
+}
+
+async function personIdTables(prisma: PrismaClient | Prisma.TransactionClient) {
+  const rows = await prisma.$queryRaw<{ table_name: string }[]>`
+    SELECT table_name
+    FROM information_schema.columns
+    WHERE table_schema = 'public' AND column_name = 'personId'
+  `;
+  return rows
+    .map((row) => row.table_name)
+    .filter((name) => /^[A-Za-z0-9_]+$/.test(name) && name !== 'Person');
+}
+
+async function moveLinks(
+  tx: Prisma.TransactionClient,
+  tables: string[],
+  keeperId: string,
+  dupId: string,
+) {
+  await tx.$executeRaw`
+    DELETE FROM "PersonGroupLink" AS d
+    USING "PersonGroupLink" AS k
+    WHERE d."personId" = ${dupId}
+      AND k."personId" = ${keeperId}
+      AND d."groupId" = k."groupId"
+  `;
+  await tx.$executeRaw`
+    DELETE FROM "PersonAccountingLink" AS d
+    USING "PersonAccountingLink" AS k
+    WHERE d."personId" = ${dupId}
+      AND k."personId" = ${keeperId}
+      AND d."connectionId" = k."connectionId"
+  `;
+  await tx.$executeRaw`
+    DELETE FROM "PartyOpeningBalance"
+    WHERE "personId" = ${dupId}
+      AND EXISTS (
+        SELECT 1 FROM "PartyOpeningBalance" AS k WHERE k."personId" = ${keeperId}
+      )
+  `;
+
+  for (const table of tables) {
+    await tx.$executeRawUnsafe(
+      `UPDATE "${table}" SET "personId" = $1 WHERE "personId" = $2`,
+      keeperId,
+      dupId,
+    );
+  }
+
+  await tx.$executeRaw`
+    UPDATE "Lead" SET "convertedPersonId" = ${keeperId} WHERE "convertedPersonId" = ${dupId}
+  `;
+  await tx.$executeRaw`
+    UPDATE "MontifyLink"
+    SET "entityId" = ${keeperId}
+    WHERE "entityType" = 'customer' AND "entityId" = ${dupId}
+  `;
+  await tx.$executeRaw`
+    UPDATE "Notification"
+    SET "entityId" = ${keeperId}
+    WHERE "entityType" = 'person' AND "entityId" = ${dupId}
+  `;
+  await tx.$executeRaw`
+    UPDATE "GamificationTransaction"
+    SET "entityId" = ${keeperId}
+    WHERE "entityType" = 'person' AND "entityId" = ${dupId}
+  `;
+  await tx.$executeRaw`
+    UPDATE "FinancialAuditLog"
+    SET "entityId" = ${keeperId}
+    WHERE "entityType" = 'person' AND "entityId" = ${dupId}
+  `;
+}
+
+export async function mergeSameMobilePeople(
+  prisma: PrismaClient,
+  organizationId: string,
+  apply: boolean,
+) {
+  const people = await prisma.person.findMany({
+    where: { organizationId },
+    select: personSelect,
+    orderBy: { createdAt: 'asc' },
+  });
+  const groups = new Map<string, PersonRow[]>();
+  for (const person of people) {
+    const key = canonicalIranMobile(person.mobile) ?? canonicalIranMobile(person.phone);
+    if (!key) continue;
+    const list = groups.get(key) ?? [];
+    list.push(person);
+    groups.set(key, list);
+  }
+
+  const duplicateGroups = [...groups.entries()].filter(([, list]) => list.length > 1);
+  const preview = duplicateGroups.map(([mobile, list]) => ({
+    mobile,
+    people: list.map((person) => ({
+      id: person.id,
+      stored: person.mobile,
+      name: `${person.firstName} ${person.lastName}`.trim(),
+    })),
+  }));
+
+  if (!apply) {
+    const needsRewrite = people.filter((person) => {
+      const canon = canonicalIranMobile(person.mobile) ?? canonicalIranMobile(person.phone);
+      return Boolean(canon && (person.mobile !== canon || canonicalIranMobile(person.phone)));
+    }).length;
+    return { merged: 0, rewritten: 0, needsRewrite, failed: 0, groups: preview };
+  }
+
+  const tables = await personIdTables(prisma);
+  let merged = 0;
+  let rewritten = 0;
+  let failed = 0;
+
+  for (const [canon, list] of groups) {
+    const ordered = [...list].sort((a, b) => {
+      const aTahesab = a.importSource === 'tahesab' ? 0 : 1;
+      const bTahesab = b.importSource === 'tahesab' ? 0 : 1;
+      if (aTahesab !== bTahesab) return aTahesab - bTahesab;
+      return a.createdAt.getTime() - b.createdAt.getTime() || a.id.localeCompare(b.id);
+    });
+    const [keeper, ...extras] = ordered;
+    if (!keeper) continue;
+    if (!extras.length) {
+      const phoneCanon = canonicalIranMobile(keeper.phone);
+      const data: Prisma.PersonUpdateInput = {};
+      if (keeper.mobile !== canon) data.mobile = canon;
+      if (phoneCanon && keeper.phone !== phoneCanon) data.phone = phoneCanon;
+      if (Object.keys(data).length) {
+        await prisma.person.update({ where: { id: keeper.id }, data });
+        rewritten += 1;
+      }
+      continue;
+    }
+
+    try {
+      await prisma.$transaction(
+        async (tx) => {
+          await tx.person.update({
+            where: { id: keeper.id },
+            data: mergedFields(keeper, extras, canon),
+          });
+          for (const extra of extras) {
+            await moveLinks(tx, tables, keeper.id, extra.id);
+            await tx.person.delete({ where: { id: extra.id } });
+            merged += 1;
+          }
+        },
+        { timeout: 60_000 },
+      );
+    } catch (error) {
+      failed += 1;
+      console.error(
+        `merge mobile ${canon} failed`,
+        error instanceof Error ? error.message : error,
+      );
+    }
+  }
+
+  return { merged, rewritten, needsRewrite: 0, failed, groups: preview };
+}
+
+function loadEnv(file: string) {
+  const text = readFileSync(file, 'utf8');
+  for (const line of text.split(/\r?\n/)) {
+    const match = line.match(/^([A-Za-z0-9_]+)=(.*)$/);
+    if (!match || process.env[match[1]]) continue;
+    let value = match[2].trim();
+    if (
+      (value.startsWith('"') && value.endsWith('"')) ||
+      (value.startsWith("'") && value.endsWith("'"))
+    ) {
+      value = value.slice(1, -1);
+    }
+    process.env[match[1]] = value;
+  }
+}
+
+const direct = process.argv[1]?.replace(/\\/g, '/').includes('merge-same-mobile');
+if (direct) {
+  loadEnv(resolve(__dirname, '../../.env'));
+  const orgId = process.argv.find((arg) => arg.startsWith('--org='))?.slice(6);
+  const apply = process.argv.includes('--apply');
+  if (!orgId) {
+    console.error('org id required: --org=<id>');
+    process.exit(1);
+  }
+  const prisma = new PrismaClient();
+  mergeSameMobilePeople(prisma, orgId, apply)
+    .then((result) => {
+      console.log(JSON.stringify({
+        apply,
+        merged: result.merged,
+        rewritten: result.rewritten,
+        needsRewrite: result.needsRewrite,
+        groupCount: result.groups.length,
+        groups: result.groups,
+      }, null, 2));
+    })
+    .catch((error) => {
+      console.error(error);
+      process.exitCode = 1;
+    })
+    .finally(() => prisma.$disconnect());
+}

apps/api/src/contacts/normalize.ts

@@ -27,3 +27,36 @@ export function normalizePhone(value?: string | null): string | null {
   const cleaned = latinDigits(v).replace(/[^\d+]/g, '');
   return cleaned.length ? cleaned : null;
 }
+
+/** موبایل ایران به شکل 09xxxxxxxxx. 912… و 98912… و +98912… همان شماره‌اند. */
+export function canonicalIranMobile(value?: string | null): string | null {
+  const n = normalizePhone(value);
+  if (!n) return null;
+  let d = n.replace(/\D/g, '');
+  if (!d) return null;
+  if (d.startsWith('0098') && d.length >= 14) d = d.slice(4);
+  else if (d.startsWith('98') && d.length >= 12) d = d.slice(2);
+  if (d.length === 10 && d.startsWith('9')) d = `0${d}`;
+  return /^09\d{9}$/.test(d) ? d : null;
+}
+
+/** شکل‌هایی که ممکن است همین موبایل با آن‌ها ذخیره شده باشد. */
+export function iranMobileLookupKeys(value?: string | null): string[] {
+  const canon = canonicalIranMobile(value);
+  if (!canon) return [];
+  const core = canon.slice(1);
+  return [canon, core, `98${core}`, `+98${core}`, `0098${core}`];
+}
+
+/** برای تطبیق: اگر موبایل ایران است همه شکل‌ها، وگرنه همان متن نرمال‌شده. */
+export function phoneIdentityKeys(value?: string | null): string[] {
+  const keys = iranMobileLookupKeys(value);
+  if (keys.length) return keys;
+  const n = normalizePhone(value);
+  return n ? [n] : [];
+}
+
+/** ذخیره: موبایل ایران همیشه 09… ؛ بقیه شماره‌ها فقط تمیز می‌شوند. */
+export function storedPhoneNumber(value?: string | null): string | null {
+  return canonicalIranMobile(value) ?? normalizePhone(value);
+}

apps/api/src/contacts/people.controller.ts

@@ -139,6 +139,7 @@ export class PeopleController {
   }
 
   @Get('birthdays')
+  @RequirePermission('customers', { reads: true })
   birthdays(@CurrentUser() user: Actor) {
     return this.peopleService.birthdaysThisMonth(user);
   }
@@ -171,7 +172,7 @@ export class PeopleController {
     @Param('id') id: string,
     @Body() dto: BirthdaySmsDto,
   ) {
-    return this.peopleService.sendBirthdaySms(user, id, dto.text);
+    return this.peopleService.sendBirthdaySms(user, id, dto.text, Boolean(dto.force));
   }
 
   @Get(':id')

apps/api/src/contacts/people.service.ts

@@ -22,13 +22,19 @@ import {
   FILTERED_IDS_MAX,
   PERSON_MOODS,
   applyPersonGenderTitle,
+  canViewAllRecords,
   splitPersonHonorific,
 } from '@mento/shared';
 import { Prisma } from '@prisma/client';
 import { PrismaService } from '../prisma/prisma.service';
 import { OutboundSmsLogService } from '../outbound-sms/outbound-sms-log.service';
 import { CompaniesService } from './companies.service';
-import { emptyToNull, normalizeEmail, normalizePhone } from './normalize';
+import {
+  emptyToNull,
+  normalizeEmail,
+  phoneIdentityKeys,
+  storedPhoneNumber,
+} from './normalize';
 import {
   asAddresses,
   asCustomFields,
@@ -43,6 +49,7 @@ import {
 import { actorCanAssignToOthers, assertAssigneeSet } from '../common/assign-access';
 import { LoyaltyService } from '../loyalty/loyalty.service';
 import { AutomationsService } from '../automations/automations.service';
+import { NotificationsService } from '../notifications/notifications.service';
 import { MessageAutomationsService } from '../message-automations/message-automations.service';
 import { WebhooksService } from '../public-api/webhooks.service';
 import { GamificationService } from '../gamification/gamification.service';
@@ -152,6 +159,7 @@ export class PeopleService implements OnModuleInit {
     private readonly outboundSms: OutboundSmsLogService,
     private readonly behaviorAccess: BehaviorAccessService,
     private readonly groups: CustomerGroupsService,
+    private readonly notifications: NotificationsService,
   ) {}
 
   private personListWhere(
@@ -213,11 +221,15 @@ export class PeopleService implements OnModuleInit {
     if (disc) and.push(disc);
     if (groupIds.length) and.push({ groupLinks: { some: { groupId: { in: groupIds } } } });
     return {
-      organizationId: actor.organizationId,
-      ...customersPersonWhere(actor),
-      ...(moods.length ? { mood: { in: moods } } : {}),
-      ...(sources.length ? { importSource: { in: sources } } : {}),
-      ...(and.length ? { AND: and } : {}),
+      AND: [
+        {
+          organizationId: actor.organizationId,
+          ...customersPersonWhere(actor),
+        },
+        ...(moods.length ? [{ mood: { in: moods } }] : []),
+        ...(sources.length ? [{ importSource: { in: sources } }] : []),
+        ...and,
+      ],
     };
   }
 
@@ -340,6 +352,7 @@ export class PeopleService implements OnModuleInit {
       fromTahesab: Boolean(g.tahesabGid),
       personCount: countMap.get(g.id) ?? 0,
       companyCount: 0,
+      assignees: [],
     }));
   }
 
@@ -399,7 +412,10 @@ export class PeopleService implements OnModuleInit {
     input: { mobile?: string | null; email?: string | null; birthDate: Date },
   ) {
     const or: Prisma.PersonWhereInput[] = [];
-    if (input.mobile) or.push({ mobile: input.mobile });
+    const mobileKeys = phoneIdentityKeys(input.mobile);
+    if (mobileKeys.length) {
+      or.push({ mobile: { in: mobileKeys } }, { phone: { in: mobileKeys } });
+    }
     if (input.email) or.push({ email: input.email });
     if (!or.length) return;
     await this.prisma.person.updateMany({
@@ -441,8 +457,8 @@ export class PeopleService implements OnModuleInit {
       importSource: normalizePersonImportSource(dto.importSource),
       sourceRef: emptyToNull(dto.sourceRef),
       email: normalizeEmail(dto.email),
-      phone: normalizePhone(dto.phone),
-      mobile: normalizePhone(dto.mobile),
+      phone: storedPhoneNumber(dto.phone),
+      mobile: storedPhoneNumber(dto.mobile),
       position: emptyToNull(dto.position),
       website: emptyToNull(dto.website),
       instagram: emptyToNull(dto.instagram),
@@ -553,8 +569,8 @@ export class PeopleService implements OnModuleInit {
     }
     if ('sourceRef' in dto) data.sourceRef = emptyToNull(dto.sourceRef);
     if ('email' in dto) data.email = normalizeEmail(dto.email);
-    if ('phone' in dto) data.phone = normalizePhone(dto.phone);
-    if ('mobile' in dto) data.mobile = normalizePhone(dto.mobile);
+    if ('phone' in dto) data.phone = storedPhoneNumber(dto.phone);
+    if ('mobile' in dto) data.mobile = storedPhoneNumber(dto.mobile);
     if ('position' in dto) data.position = emptyToNull(dto.position);
     if ('website' in dto) data.website = emptyToNull(dto.website);
     if ('instagram' in dto) data.instagram = emptyToNull(dto.instagram);
@@ -641,10 +657,13 @@ export class PeopleService implements OnModuleInit {
   ) {
     const email = typeof data.email === 'string' ? data.email : null;
     const mobile = typeof data.mobile === 'string' ? data.mobile : null;
+    const mobileKeys = phoneIdentityKeys(mobile);
 
     const or: Prisma.PersonWhereInput[] = [];
     if (email) or.push({ email });
-    if (mobile) or.push({ mobile });
+    if (mobileKeys.length) {
+      or.push({ mobile: { in: mobileKeys } }, { phone: { in: mobileKeys } });
+    }
     if (!or.length) return;
 
     const clash = await this.prisma.person.findFirst({
@@ -669,8 +688,8 @@ export class PeopleService implements OnModuleInit {
     const rows = await this.prisma.person.findMany({
       where: {
         organizationId: actor.organizationId,
-        ownerId: actor.userId,
         birthDate: { not: null },
+        ...customersPersonWhere(actor),
       },
       select: {
         id: true,
@@ -717,13 +736,17 @@ export class PeopleService implements OnModuleInit {
     };
   }
 
-  async sendBirthdaySms(actor: Actor, personId: string, text: string) {
+  async sendBirthdaySms(actor: Actor, personId: string, text: string, force = false) {
     const body = text.trim();
     if (!body || body.length > 500) {
       throw new BadRequestException('متن پیامک را تا ۵۰۰ نویسه بنویسید.');
     }
     const person = await this.prisma.person.findFirst({
-      where: { id: personId, organizationId: actor.organizationId },
+      where: {
+        id: personId,
+        organizationId: actor.organizationId,
+        ...customersPersonWhere(actor),
+      },
       select: {
         id: true,
         firstName: true,
@@ -733,11 +756,29 @@ export class PeopleService implements OnModuleInit {
         ownerId: true,
         birthDate: true,
         company: { select: { name: true } },
+        groupLinks: {
+          select: {
+            group: {
+              select: {
+                assignees: { select: { id: true, fullName: true } },
+              },
+            },
+          },
+        },
       },
     });
     if (!person) throw new NotFoundException('مشتری پیدا نشد');
-    if (person.ownerId !== actor.userId) {
-      throw new ForbiddenException('فقط مسئول این مشتری می‌تواند پیامک تبریک بفرستد.');
+    const assigneeIds = new Set(
+      person.groupLinks.flatMap((link) => link.group.assignees.map((a) => a.id)),
+    );
+    const canSend =
+      canViewAllRecords(actor.role) ||
+      person.ownerId === actor.userId ||
+      assigneeIds.has(actor.userId);
+    if (!canSend) {
+      throw new ForbiddenException(
+        'فقط مالک مشتری یا مسئول گروه او می‌تواند پیامک تبریک بفرستد.',
+      );
     }
     if (!person.birthDate) {
       throw new BadRequestException('برای این مشتری تاریخ تولد ثبت نشده است.');
@@ -759,6 +800,32 @@ export class PeopleService implements OnModuleInit {
     const mobile = person.mobile || person.phone;
     if (!mobile) throw new BadRequestException('برای این مشتری شماره موبایل ثبت نشده است.');
     const fullName = `${person.firstName} ${person.lastName}`.trim();
+    const birthdayKey = `birthday:${inMonth.year}-${inMonth.month}`;
+    if (!force) {
+      const prior = await this.prisma.outboundSmsLog.findFirst({
+        where: {
+          organizationId: actor.organizationId,
+          personId: person.id,
+          status: 'sent',
+          sourceId: birthdayKey,
+          NOT: { actorUserId: actor.userId },
+        },
+        orderBy: { createdAt: 'desc' },
+        select: { actorUserId: true },
+      });
+      if (prior) {
+        const priorUser = prior.actorUserId
+          ? await this.prisma.user.findFirst({
+              where: { id: prior.actorUserId },
+              select: { fullName: true },
+            })
+          : null;
+        const who = priorUser?.fullName?.trim() || 'مسئول دیگری';
+        throw new ConflictException(
+          `${who} قبلاً پیامک تبریک این مشتری را فرستاده است. آیا می‌خواهید دوباره بفرستید؟`,
+        );
+      }
+    }
     const message = renderSmsText(body, {
       name: fullName,
       phone: mobile,
@@ -778,6 +845,7 @@ export class PeopleService implements OnModuleInit {
       mobile,
       body: message,
       source: 'manual',
+      sourceId: birthdayKey,
       status: result.ok ? 'sent' : 'failed',
       error: result.ok ? null : result.reason,
       actorUserId: actor.userId,
@@ -791,6 +859,28 @@ export class PeopleService implements OnModuleInit {
             : 'پیامک ارسال نشد. کمی بعد دوباره تلاش کنید.',
       );
     }
+    const senderName = (
+      await this.prisma.user.findFirst({
+        where: { id: actor.userId },
+        select: { fullName: true },
+      })
+    )?.fullName?.trim() || 'یکی از مسئولان';
+    const peers = [...assigneeIds].filter((id) => id !== actor.userId);
+    await Promise.all(
+      peers.map((userId) =>
+        this.notifications.create({
+          organizationId: actor.organizationId,
+          userId,
+          type: 'birthday_sms_sent',
+          title: 'پیامک تبریک تولد ارسال شد',
+          body: `${senderName} برای «${fullName}» پیامک تبریک فرستاد. اگر لازم است می‌توانید دوباره بفرستید.`,
+          link: `/contacts/people/${person.id}`,
+          entityType: 'person',
+          entityId: person.id,
+          dedupe: false,
+        }),
+      ),
+    );
     return { ok: true };
   }
 

apps/api/src/contacts/same-mobile-merge.service.ts

@@ -0,0 +1,85 @@
+import { Injectable, Logger, type OnApplicationBootstrap } from '@nestjs/common';
+import { PrismaService } from '../prisma/prisma.service';
+import { mergeSameMobilePeople } from './merge-same-mobile';
+
+const FIX_KEY = 'person-mobile-canonical-v3';
+
+@Injectable()
+export class SameMobileMergeService implements OnApplicationBootstrap {
+  private readonly logger = new Logger(SameMobileMergeService.name);
+
+  constructor(private readonly prisma: PrismaService) {}
+
+  onApplicationBootstrap() {
+    if (process.env.NODE_ENV === 'test') return;
+    void this.run();
+  }
+
+  private async run() {
+    try {
+      const ready = await this.prisma.$queryRaw<{ ok: number }[]>`
+        SELECT 1 AS ok
+        FROM information_schema.columns
+        WHERE table_schema = 'public'
+          AND lower(table_name) = 'person'
+          AND lower(column_name) = 'gender'
+      `;
+      if (!ready.length) {
+        this.logger.warn('یکسان‌سازی موبایل رد شد: ستون gender هنوز نیست');
+        return;
+      }
+
+      await this.prisma.$executeRaw`
+        CREATE TABLE IF NOT EXISTS "DataFix" (
+          "key" TEXT PRIMARY KEY,
+          "doneAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP
+        )
+      `;
+
+      const done = await this.prisma.$queryRaw<{ key: string }[]>`
+        SELECT "key" FROM "DataFix" WHERE "key" = ${FIX_KEY}
+      `;
+      if (done.length) return;
+
+      await this.prisma.$executeRaw`SELECT pg_advisory_lock(86051205)`;
+      try {
+        const again = await this.prisma.$queryRaw<{ key: string }[]>`
+          SELECT "key" FROM "DataFix" WHERE "key" = ${FIX_KEY}
+        `;
+        if (again.length) return;
+
+        const orgs = await this.prisma.organization.findMany({ select: { id: true } });
+        let merged = 0;
+        let rewritten = 0;
+        let failed = 0;
+        for (const org of orgs) {
+          try {
+            const result = await mergeSameMobilePeople(this.prisma, org.id, true);
+            merged += result.merged;
+            rewritten += result.rewritten;
+            failed += result.failed;
+          } catch (error) {
+            failed += 1;
+            this.logger.error(
+              `یکسان‌سازی موبایل برای محیط ${org.id} انجام نشد`,
+              error instanceof Error ? error.message : String(error),
+            );
+          }
+        }
+        if (failed) return;
+        await this.prisma.$executeRaw`
+          INSERT INTO "DataFix" ("key") VALUES (${FIX_KEY})
+          ON CONFLICT ("key") DO NOTHING
+        `;
+        this.logger.log(`شماره‌های تکراری یکی شد: ${merged} ادغام، ${rewritten} بازنویسی`);
+      } finally {
+        await this.prisma.$executeRaw`SELECT pg_advisory_unlock(86051205)`;
+      }
+    } catch (error) {
+      this.logger.error(
+        'یکسان‌سازی موبایل مشتری‌ها انجام نشد',
+        error instanceof Error ? error.stack : String(error),
+      );
+    }
+  }
+}

apps/api/src/customer-groups/customer-groups.controller.ts

@@ -8,7 +8,14 @@ import {
   Post,
   UseGuards,
 } from '@nestjs/common';
-import { IsIn, IsOptional, IsString, MaxLength, MinLength } from 'class-validator';
+import {
+  IsArray,
+  IsIn,
+  IsOptional,
+  IsString,
+  MaxLength,
+  MinLength,
+} from 'class-validator';
 import { CUSTOMER_GROUP_COLORS, type CustomerGroupColor } from '@mento/shared';
 import { JwtAuthGuard } from '../auth/jwt-auth.guard';
 import { RolesGuard } from '../auth/roles.guard';
@@ -26,6 +33,11 @@ class CreateCustomerGroupDto {
   @IsOptional()
   @IsIn([...CUSTOMER_GROUP_COLORS])
   color?: CustomerGroupColor;
+
+  @IsOptional()
+  @IsArray()
+  @IsString({ each: true })
+  assigneeIds?: string[];
 }
 
 class UpdateCustomerGroupDto {
@@ -43,6 +55,11 @@ class UpdateCustomerGroupDto {
   @IsOptional()
   @IsString()
   parentId?: string | null;
+
+  @IsOptional()
+  @IsArray()
+  @IsString({ each: true })
+  assigneeIds?: string[];
 }
 
 @Controller('customer-groups')

apps/api/src/customer-groups/customer-groups.service.ts

@@ -51,26 +51,21 @@ export class CustomerGroupsService {
       include: {
         _count: { select: { people: true, companies: true } },
         parent: { select: { name: true } },
+        assignees: { select: { id: true, fullName: true }, orderBy: { fullName: 'asc' } },
       },
     });
-    return rows.map((r) => ({
-      id: r.id,
-      name: r.name,
-      color: r.color,
-      position: r.position,
-      fromTahesab: Boolean(r.tahesabGid),
-      personCount: r._count.people,
-      companyCount: r._count.companies,
-      parentId: r.parentId,
-      parentName: r.parent?.name ?? null,
-    }));
+    return rows.map((r) => this.toDto(r));
   }
 
   async create(
     organizationId: string,
-    dto: { name: string; color?: CustomerGroupColor },
+    dto: { name: string; color?: CustomerGroupColor; assigneeIds?: string[] },
   ): Promise<CustomerGroupDto> {
     const name = this.cleanName(dto.name);
+    const assigneeIds =
+      dto.assigneeIds !== undefined
+        ? await this.validAssigneeIds(organizationId, dto.assigneeIds)
+        : [];
     const max = await this.prisma.customerGroup.aggregate({
       where: { organizationId },
       _max: { position: true },
@@ -82,6 +77,9 @@ export class CustomerGroupsService {
           name,
           color: this.cleanColor(dto.color),
           position: (max._max.position ?? -1) + 1,
+          ...(assigneeIds.length
+            ? { assignees: { connect: assigneeIds.map((id) => ({ id })) } }
+            : {}),
         },
       });
     } catch (e) {
@@ -93,7 +91,12 @@ export class CustomerGroupsService {
   async update(
     organizationId: string,
     id: string,
-    dto: { name?: string; color?: CustomerGroupColor; parentId?: string | null },
+    dto: {
+      name?: string;
+      color?: CustomerGroupColor;
+      parentId?: string | null;
+      assigneeIds?: string[];
+    },
   ): Promise<CustomerGroupDto> {
     await this.require(organizationId, id);
     const parentId =
@@ -101,6 +104,10 @@ export class CustomerGroupsService {
     if (parentId !== undefined) {
       await this.assertParent(organizationId, id, parentId);
     }
+    const assigneeIds =
+      dto.assigneeIds !== undefined
+        ? await this.validAssigneeIds(organizationId, dto.assigneeIds)
+        : undefined;
     try {
       await this.prisma.customerGroup.update({
         where: { id },
@@ -108,6 +115,9 @@ export class CustomerGroupsService {
           ...(dto.name != null ? { name: this.cleanName(dto.name) } : {}),
           ...(dto.color != null ? { color: this.cleanColor(dto.color) } : {}),
           ...(parentId !== undefined ? { parentId } : {}),
+          ...(assigneeIds !== undefined
+            ? { assignees: { set: assigneeIds.map((uid) => ({ id: uid })) } }
+            : {}),
         },
       });
     } catch (e) {
@@ -317,6 +327,48 @@ export class CustomerGroupsService {
     return link?.group.name ?? null;
   }
 
+  private toDto(r: {
+    id: string;
+    name: string;
+    color: string;
+    position: number;
+    tahesabGid: string | null;
+    parentId: string | null;
+    parent?: { name: string } | null;
+    _count: { people: number; companies: number };
+    assignees: Array<{ id: string; fullName: string }>;
+  }): CustomerGroupDto {
+    return {
+      id: r.id,
+      name: r.name,
+      color: r.color,
+      position: r.position,
+      fromTahesab: Boolean(r.tahesabGid),
+      personCount: r._count.people,
+      companyCount: r._count.companies,
+      parentId: r.parentId,
+      parentName: r.parent?.name ?? null,
+      assignees: r.assignees.map((a) => ({ id: a.id, fullName: a.fullName })),
+    };
+  }
+
+  private async validAssigneeIds(organizationId: string, ids: string[]): Promise<string[]> {
+    const unique = [...new Set((ids ?? []).map((id) => id?.trim()).filter(Boolean))];
+    if (!unique.length) return [];
+    const rows = await this.prisma.user.findMany({
+      where: {
+        id: { in: unique },
+        isActive: true,
+        memberships: { some: { organizationId, isActive: true } },
+      },
+      select: { id: true },
+    });
+    if (rows.length !== unique.length) {
+      throw new BadRequestException('یکی از مسئولان انتخاب‌شده معتبر نیست');
+    }
+    return rows.map((r) => r.id);
+  }
+
   private async require(organizationId: string, id: string) {
     const row = await this.prisma.customerGroup.findFirst({
       where: { id, organizationId },

apps/api/src/integrations/montify/sync.service.ts

@@ -17,7 +17,11 @@ import type {
 } from '@mento/shared';
 import { parseBirthDate } from '../../common/excel';
 import { PrismaService } from '../../prisma/prisma.service';
-import { normalizeEmail, normalizePhone } from '../../contacts/normalize';
+import {
+  normalizeEmail,
+  phoneIdentityKeys,
+  storedPhoneNumber,
+} from '../../contacts/normalize';
 import { carryPreviousSource } from '../../contacts/person-source';
 import { ownerWhere, type Actor } from '../../common/record-scope';
 import { MontifyConnectionsService } from './connections.service';
@@ -100,13 +104,7 @@ function arr(v: unknown): unknown[] {
 }
 
 function mobileVariants(mobile: string): string[] {
-  const digits = mobile.replace(/\D/g, '');
-  let core = digits;
-  if (core.startsWith('0098')) core = core.slice(4);
-  else if (core.startsWith('98') && core.length === 12) core = core.slice(2);
-  else if (core.startsWith('0')) core = core.slice(1);
-  if (!core) return [mobile];
-  return [...new Set([mobile, core, `0${core}`, `98${core}`, `+98${core}`])];
+  return phoneIdentityKeys(mobile);
 }
 
 function formatAddress(a: MontifyAddress): string | null {
@@ -417,7 +415,7 @@ export class MontifySyncService {
   }> {
     const externalId = String(c.id);
     const { firstName, lastName } = splitName(c);
-    const mobile = normalizePhone(c.phone ?? null);
+    const mobile = storedPhoneNumber(c.phone ?? null);
     const email = normalizeEmail(c.email ?? null);
     const addressLines = addresses.map(formatAddress).filter((a): a is string => Boolean(a));
     const profile: CustomerProfile = {

apps/api/src/integrations/tahesab/__tests__/tahesab-unit.check.ts

@@ -1,4 +1,11 @@
 import { createCipheriv, createDecipheriv, randomBytes } from 'crypto';
+import {
+  pickAddress,
+  pickCity,
+  pickNationalId,
+  pickRasteh,
+  tahesabProfilePatch,
+} from '../moshtari-profile';
 import {
   assertFactorCode,
   buildFactorCode,
@@ -116,12 +123,52 @@ function testSanadBuilders() {
   assert(bank[12] === fc, 'bank factor index');
 }
 
+function testMoshtariProfile() {
+  const row = {
+    CodeMelli: '00112312311',
+    Address: 'خیابان ولیعصر',
+    City: 'تهران',
+    Rasteh: 2,
+    BDate: null,
+  };
+  assert(pickNationalId(row) === '00112312311', 'national id');
+  assert(pickAddress(row) === 'خیابان ولیعصر', 'address');
+  assert(pickCity(row) === 'تهران', 'city');
+  assert(pickRasteh(row) === 2, 'rasteh');
+  assert(pickNationalId({ CodeMelli: '-1' }) == null, 'skip -1 national');
+
+  const patch = tahesabProfilePatch(row, {
+    birthDate: null,
+    addresses: [],
+    customFields: { keep: true },
+  });
+  assert(Array.isArray(patch.addresses) && patch.addresses[0] === 'خیابان ولیعصر، تهران', 'addr+city');
+  const fields = patch.customFields as Record<string, unknown>;
+  assert(fields.nationalId === '00112312311', 'cf national');
+  assert(fields.city === 'تهران', 'cf city');
+  assert(fields.rasteh === 2, 'cf rasteh');
+  assert(fields.keep === true, 'cf merge');
+
+  const emptyKeep = tahesabProfilePatch(
+    { CodeMelli: '', Address: '', City: '', Rasteh: '' },
+    {
+      birthDate: new Date('2000-01-01'),
+      addresses: ['قدیمی'],
+      customFields: { nationalId: '111' },
+    },
+  );
+  assert(emptyKeep.addresses == null, 'empty does not wipe address');
+  assert(emptyKeep.customFields == null, 'empty does not wipe custom');
+  assert(emptyKeep.birthDate == null, 'existing birth kept');
+}
+
 function main() {
   testCryptoRoundtrip();
   testFactorCode();
   testMobile();
   testMandehNormalize();
   testSanadBuilders();
+  testMoshtariProfile();
   console.log('tahesab unit checks: OK');
 }
 

apps/api/src/integrations/tahesab/connections.service.ts

@@ -43,6 +43,10 @@ export class TahesabConnectionsService {
     lastHealthAt: Date | null;
     lastHealthOk: boolean | null;
     lastError: string | null;
+    customerSyncHours: number[];
+    customerSyncLastRunAt: Date | null;
+    customerSyncLastSummary: string | null;
+    customerSyncLastError: string | null;
     createdAt: Date;
     updatedAt: Date;
   }) {
@@ -60,6 +64,10 @@ export class TahesabConnectionsService {
       lastHealthAt: row.lastHealthAt?.toISOString() ?? null,
       lastHealthOk: row.lastHealthOk,
       lastError: row.lastError,
+      customerSyncHours: [...row.customerSyncHours].sort((a, b) => a - b),
+      customerSyncLastRunAt: row.customerSyncLastRunAt?.toISOString() ?? null,
+      customerSyncLastSummary: row.customerSyncLastSummary,
+      customerSyncLastError: row.customerSyncLastError,
       createdAt: row.createdAt.toISOString(),
       updatedAt: row.updatedAt.toISOString(),
     };
@@ -201,6 +209,15 @@ export class TahesabConnectionsService {
 
     if (dto.isDefault === true) await this.clearOtherDefaults(organizationId, id);
 
+    let customerSyncHours: number[] | undefined;
+    if (dto.customerSyncHours !== undefined) {
+      const hours = dto.customerSyncHours.map((hour) => Math.trunc(hour));
+      if (new Set(hours).size !== hours.length) {
+        throw new BadRequestException('ساعت‌های بروزرسانی نباید تکراری باشند.');
+      }
+      customerSyncHours = [...hours].sort((a, b) => a - b);
+    }
+
     let enc = {
       ciphertext: row.tokenCiphertext,
       iv: row.tokenIv,
@@ -225,6 +242,7 @@ export class TahesabConnectionsService {
         enabled: dto.enabled ?? row.enabled,
         isDefault: dto.isDefault === true ? true : dto.isDefault === false ? false : row.isDefault,
         allowInsecureTls: dto.allowInsecureTls ?? row.allowInsecureTls,
+        ...(customerSyncHours !== undefined ? { customerSyncHours } : {}),
       },
     });
     return this.toDto(updated);

apps/api/src/integrations/tahesab/customer-sync.scheduler.ts

@@ -0,0 +1,99 @@
+import { Injectable, Logger } from '@nestjs/common';
+import { Cron } from '@nestjs/schedule';
+import { PrismaService } from '../../prisma/prisma.service';
+import { TahesabPersonLinkService } from './person-link.service';
+
+/** ساعت و تاریخ امروز به وقت تهران، برای نوبت یک‌بار در هر ساعت. */
+export function tehranSyncSlot(now = new Date()): { hour: number; slot: string } {
+  const parts = new Intl.DateTimeFormat('en-GB', {
+    timeZone: 'Asia/Tehran',
+    year: 'numeric',
+    month: '2-digit',
+    day: '2-digit',
+    hour: '2-digit',
+    hourCycle: 'h23',
+  }).formatToParts(now);
+  const read = (type: Intl.DateTimeFormatPartTypes) =>
+    parts.find((part) => part.type === type)?.value ?? '';
+  let hour = Number(read('hour'));
+  if (!Number.isFinite(hour) || hour === 24) hour = 0;
+  const slot = `${read('year')}-${read('month')}-${read('day')}-${String(hour).padStart(2, '0')}`;
+  return { hour, slot };
+}
+
+@Injectable()
+export class TahesabCustomerSyncScheduler {
+  private readonly logger = new Logger(TahesabCustomerSyncScheduler.name);
+  private busy = false;
+
+  constructor(
+    private readonly prisma: PrismaService,
+    private readonly links: TahesabPersonLinkService,
+  ) {}
+
+  @Cron('* * * * *', { timeZone: 'Asia/Tehran' })
+  async tick() {
+    if (process.env.NODE_ENV === 'test' || this.busy) return;
+    this.busy = true;
+    try {
+      const { hour, slot } = tehranSyncSlot();
+      const connections = await this.prisma.accountingConnection.findMany({
+        where: {
+          provider: 'tahesab',
+          enabled: true,
+          customerSyncHours: { has: hour },
+        },
+        select: { id: true, organizationId: true, label: true, customerSyncLastSlot: true },
+      });
+      for (const connection of connections) {
+        if (connection.customerSyncLastSlot === slot) continue;
+        const claimed = await this.prisma.accountingConnection.updateMany({
+          where: {
+            id: connection.id,
+            OR: [
+              { customerSyncLastSlot: null },
+              { customerSyncLastSlot: { not: slot } },
+            ],
+          },
+          data: { customerSyncLastSlot: slot },
+        });
+        if (claimed.count !== 1) continue;
+        await this.run(connection.organizationId, connection.id, connection.label);
+      }
+    } catch (err) {
+      this.logger.warn(
+        `بررسی زمان‌بندی مشتریان ته‌حساب ناموفق بود: ${
+          err instanceof Error ? err.message : err
+        }`,
+      );
+    } finally {
+      this.busy = false;
+    }
+  }
+
+  private async run(organizationId: string, connectionId: string, label: string) {
+    try {
+      const result = await this.links.syncAllCustomers(organizationId, connectionId);
+      await this.prisma.accountingConnection.update({
+        where: { id: connectionId },
+        data: {
+          customerSyncLastRunAt: new Date(),
+          customerSyncLastSummary: result.summary,
+          customerSyncLastError: result.error,
+        },
+      });
+      this.logger.log(`بروزرسانی خودکار «${label}»: ${result.summary}`);
+    } catch (err) {
+      const message = (err instanceof Error ? err.message : 'همگام‌سازی ناموفق بود').slice(0, 500);
+      await this.prisma.accountingConnection.update({
+        where: { id: connectionId },
+        data: {
+          customerSyncLastRunAt: new Date(),
+          customerSyncLastSummary: null,
+          customerSyncLastError: message,
+        },
+      });
+      this.logger.warn(`بروزرسانی خودکار «${label}» ناموفق بود: ${message}`);
+    }
+  }
+}

apps/api/src/integrations/tahesab/dto.ts

@@ -86,6 +86,16 @@ export class UpdateTahesabConnectionDto {
   @IsOptional()
   @IsBoolean()
   allowInsecureTls?: boolean;
+
+  /** ساعت‌های ۰ تا ۲۳. آرایهٔ خالی یعنی خاموش. */
+  @IsOptional()
+  @IsArray()
+  @ArrayMaxSize(6)
+  @Type(() => Number)
+  @IsInt({ each: true })
+  @Min(0, { each: true })
+  @Max(23, { each: true })
+  customerSyncHours?: number[];
 }
 
 export class ManualLinkDto {
@@ -195,6 +205,12 @@ export class SyncGroupsPageDto {
   pageSize?: number;
 }
 
+/** اجرای دستی همگام‌سازی همهٔ مشتریان (وارد + به‌روز کردن لینک‌شده‌ها) */
+export class SyncAllCustomersDto {
+  @IsString()
+  connectionId!: string;
+}
+
 export class ExportPeopleToTahesabDto {
   @IsString()
   connectionId!: string;

apps/api/src/integrations/tahesab/moshtari-profile.ts

@@ -0,0 +1,113 @@
+import { Prisma } from '@prisma/client';
+import { parseBirthDate } from '../../common/excel';
+
+export function pickBirthDate(row: Record<string, unknown>): Date | null {
+  const raw =
+    row.BDate ??
+    row.bDate ??
+    row.Tarikh_Tavalod ??
+    row.tarikh_tavalod ??
+    row.BirthDate;
+  if (raw == null) return null;
+  return parseBirthDate(String(raw));
+}
+
+function trimStr(raw: unknown): string | null {
+  if (raw == null) return null;
+  const s = String(raw).trim();
+  if (!s || s === '-1') return null;
+  return s;
+}
+
+/** کد ملی از پاسخ لیست مشتری ته‌حساب */
+export function pickNationalId(row: Record<string, unknown>): string | null {
+  return (
+    trimStr(row.CodeMelli) ??
+    trimStr(row.CodeMeli) ??
+    trimStr(row.codeMeli) ??
+    trimStr(row.NationalId) ??
+    null
+  );
+}
+
+export function pickAddress(row: Record<string, unknown>): string | null {
+  return trimStr(row.Address) ?? trimStr(row.address) ?? null;
+}
+
+export function pickCity(row: Record<string, unknown>): string | null {
+  return trimStr(row.City) ?? trimStr(row.city) ?? trimStr(row.Shahr) ?? null;
+}
+
+/** رسته حساب در ته‌حساب (عدد یا رشته) */
+export function pickRasteh(row: Record<string, unknown>): string | number | null {
+  const raw = row.Rasteh ?? row.rasteh ?? row.Raste;
+  if (raw == null || raw === '') return null;
+  if (typeof raw === 'number' && Number.isFinite(raw)) return raw;
+  const s = String(raw).trim();
+  if (!s || s === '-1') return null;
+  const n = Number(s);
+  return Number.isFinite(n) && String(n) === s ? n : s;
+}
+
+function asCustomFieldRecord(raw: unknown): Record<string, unknown> {
+  if (raw && typeof raw === 'object' && !Array.isArray(raw)) {
+    return { ...(raw as Record<string, unknown>) };
+  }
+  return {};
+}
+
+function asAddressList(raw: unknown): string[] {
+  if (!Array.isArray(raw)) return [];
+  return raw
+    .map((a) => (typeof a === 'string' ? a.trim() : ''))
+    .filter(Boolean);
+}
+
+/**
+ * فیلدهای پروفایل قابل‌دریافت از DoListMoshtari را روی شخص می‌نشاند.
+ * مقدار خالی ته‌حساب، دادهٔ موجود CRM را پاک نمی‌کند.
+ */
+export function tahesabProfilePatch(
+  row: Record<string, unknown>,
+  existing: {
+    birthDate: Date | null;
+    addresses: unknown;
+    customFields: unknown;
+  },
+): Prisma.PersonUpdateInput {
+  const data: Prisma.PersonUpdateInput = {};
+  const birthDate = pickBirthDate(row);
+  if (!existing.birthDate && birthDate) data.birthDate = birthDate;
+
+  const address = pickAddress(row);
+  const city = pickCity(row);
+  if (address) {
+    const line = city ? `${address}، ${city}` : address;
+    data.addresses = [line] as Prisma.InputJsonValue;
+  } else if (city && asAddressList(existing.addresses).length === 0) {
+    data.addresses = [city] as Prisma.InputJsonValue;
+  }
+
+  const fields = asCustomFieldRecord(existing.customFields);
+  let fieldsChanged = false;
+  const nationalId = pickNationalId(row);
+  if (nationalId) {
+    fields.nationalId = nationalId;
+    fieldsChanged = true;
+  }
+  if (city) {
+    fields.city = city;
+    fieldsChanged = true;
+  }
+  if (address) {
+    fields.address = address;
+    fieldsChanged = true;
+  }
+  const rasteh = pickRasteh(row);
+  if (rasteh != null) {
+    fields.rasteh = rasteh;
+    fieldsChanged = true;
+  }
+  if (fieldsChanged) data.customFields = fields as Prisma.InputJsonValue;
+  return data;
+}

apps/api/src/integrations/tahesab/person-link.service.ts

@@ -8,7 +8,12 @@ import {
 } from '@nestjs/common';
 import { Prisma } from '@prisma/client';
 import { PrismaService } from '../../prisma/prisma.service';
-import { carryPreviousSource } from '../../contacts/person-source';
+import { carryPreviousSource, namesDiffer } from '../../contacts/person-source';
+import {
+  canonicalIranMobile,
+  phoneIdentityKeys,
+  storedPhoneNumber,
+} from '../../contacts/normalize';
 import { applyPersonGenderTitle } from '@mento/shared';
 import { TahesabConnectionsService } from './connections.service';
 import {
@@ -21,10 +26,25 @@ import {
   SearchTahesabDto,
   SyncGroupsPageDto,
 } from './dto';
-import { formatJalaliDate, parseBirthDate } from '../../common/excel';
+import { formatJalaliDate } from '../../common/excel';
 import { CustomerGroupsService } from '../../customer-groups/customer-groups.service';
+import { pickBirthDate, tahesabProfilePatch } from './moshtari-profile';
 import { normalizeIranMobile, SanadBuilders, type TahesabApi } from './tahesab-methods';
 
+/** موبایل ته‌حساب را به شکل 0912… ذخیره می‌کند، حتی اگر قبلاً 912… یا +98912… بوده باشد. */
+function canonicalMobileUpdate(
+  incoming: string | null,
+  current: { mobile: string | null; phone: string | null },
+): { mobile?: string; phone?: string } {
+  const mobile =
+    canonicalIranMobile(incoming) ??
+    canonicalIranMobile(current.mobile) ??
+    canonicalIranMobile(current.phone);
+  if (!mobile) return {};
+  const phone = canonicalIranMobile(current.phone);
+  return phone ? { mobile, phone } : { mobile };
+}
+
 /** اندازهٔ هر صفحهٔ «همه» (بازهٔ کد) — امن برای پروکسی/nginx */
 const LIST_PAGE_SIZE = 2000;
 const LIST_TIMEOUT_MS = 55_000;
@@ -64,17 +84,6 @@ function pickTel(row: Record<string, unknown>): string {
   return String(row.Tel ?? row.Phone ?? row.Mobile ?? row.tel ?? '');
 }
 
-function pickBirthDate(row: Record<string, unknown>): Date | null {
-  const raw =
-    row.BDate ??
-    row.bDate ??
-    row.Tarikh_Tavalod ??
-    row.tarikh_tavalod ??
-    row.BirthDate;
-  if (raw == null) return null;
-  return parseBirthDate(String(raw));
-}
-
 function firstAddress(raw: unknown): string | undefined {
   if (!Array.isArray(raw)) return undefined;
   const first = raw.find((a) => typeof a === 'string' && a.trim());
@@ -419,6 +428,77 @@ export class TahesabPersonLinkService {
     };
   }
 
+  /**
+   * کدهایی که لینک ندارند ولی شماره‌شان مال مشتریِ از قبل لینک‌شدهٔ همین اتصال است.
+   * یک شخص فقط یک کد ته‌حساب دارد؛ این کدها مشتری تازه نیستند.
+   */
+  private async duplicateOwners(
+    organizationId: string,
+    connectionId: string,
+    rows: Array<{ moshtariCode: number | null; tel: string }>,
+  ) {
+    const pending = rows.filter(
+      (row): row is { moshtariCode: number; tel: string } => row.moshtariCode != null,
+    );
+    const keys = [
+      ...new Set(pending.flatMap((row) => phoneIdentityKeys(storedPhoneNumber(row.tel)))),
+    ];
+    const out = new Map<
+      number,
+      { moshtariCode: number; personId: string; personName: string }
+    >();
+    if (!keys.length) return out;
+
+    const people = await this.prisma.person.findMany({
+      where: {
+        organizationId,
+        OR: [{ mobile: { in: keys } }, { phone: { in: keys } }],
+        accountingLinks: { some: { connectionId } },
+      },
+      select: {
+        id: true,
+        firstName: true,
+        lastName: true,
+        mobile: true,
+        phone: true,
+        accountingLinks: {
+          where: { connectionId },
+          select: { moshtariCode: true },
+          take: 1,
+        },
+      },
+    });
+    const byKey = new Map<
+      string,
+      { moshtariCode: number; personId: string; personName: string }
+    >();
+    for (const person of people) {
+      const link = person.accountingLinks[0];
+      if (!link) continue;
+      const info = {
+        moshtariCode: link.moshtariCode,
+        personId: person.id,
+        personName: `${person.firstName} ${person.lastName}`.trim(),
+      };
+      for (const key of [
+        ...phoneIdentityKeys(person.mobile),
+        ...phoneIdentityKeys(person.phone),
+      ]) {
+        if (!byKey.has(key)) byKey.set(key, info);
+      }
+    }
+    for (const row of pending) {
+      for (const key of phoneIdentityKeys(storedPhoneNumber(row.tel))) {
+        const hit = byKey.get(key);
+        if (hit && hit.moshtariCode !== row.moshtariCode) {
+          out.set(row.moshtariCode, hit);
+          break;
+        }
+      }
+    }
+    return out;
+  }
+
   async search(organizationId: string, dto: SearchTahesabDto) {
     const { api } = await this.connections.getApi(
       organizationId,
@@ -497,7 +577,7 @@ export class TahesabPersonLinkService {
           });
     const byCode = new Map(existing.map((e) => [e.moshtariCode, e]));
 
-    const results = mapped.map((row) => {
+    const linked = mapped.map((row) => {
       const link = row.moshtariCode != null ? byCode.get(row.moshtariCode) : undefined;
       return {
         ...row,
@@ -508,6 +588,22 @@ export class TahesabPersonLinkService {
           : null,
       };
     });
+    const duplicates = await this.duplicateOwners(
+      organizationId,
+      dto.connectionId,
+      linked.filter((row) => !row.alreadyLinked),
+    );
+    const results = linked.map((row) => {
+      if (row.alreadyLinked || row.moshtariCode == null) return row;
+      const dup = duplicates.get(row.moshtariCode);
+      if (!dup) return row;
+      return {
+        ...row,
+        duplicateOfCode: dup.moshtariCode,
+        duplicatePersonId: dup.personId,
+        duplicatePersonName: dup.personName,
+      };
+    });
 
     await this.prisma.accountingSyncJob.create({
       data: {
@@ -539,6 +635,7 @@ export class TahesabPersonLinkService {
     organizationId: string,
     dto: ImportFromTahesabDto,
     prefetched?: { api: TahesabApi; row?: Record<string, unknown> },
+    options?: { skipJob?: boolean },
   ) {
     const clash = await this.prisma.personAccountingLink.findFirst({
       where: {
@@ -577,7 +674,7 @@ export class TahesabPersonLinkService {
     const named = applyPersonGenderTitle({ firstName: name, lastName: '' });
     const firstName = named.firstName;
     const lastName = named.lastName;
-    const mobile = tel || null;
+    const mobile = storedPhoneNumber(tel);
     const sourceRef = String(dto.moshtariCode);
 
     let personId = dto.personId;
@@ -603,29 +700,49 @@ export class TahesabPersonLinkService {
           ...carryPreviousSource(existing, 'tahesab'),
           importSource: 'tahesab',
           sourceRef,
-          ...(!existing.birthDate && pickBirthDate(row) ? { birthDate: pickBirthDate(row) } : {}),
-          ...(mobile
-            ? {
-                mobile: existing.mobile || mobile,
-                phone: existing.phone || mobile,
-              }
-            : {}),
+          ...canonicalMobileUpdate(mobile, existing),
+          ...tahesabProfilePatch(row, existing),
         },
       });
     } else {
       // اگر موبایل تکراری است → همان شخص؛ نام قبلی حفظ و نام ته‌حساب جایگزین.
-      // شخصی که روی همین اتصال به کد دیگری لینک است کنار گذاشته می‌شود؛
-      // وگرنه upsert لینک، کد قبلی را جابه‌جا و آن مشتری را دوباره «واردنشده» می‌کند.
-      const byMobile = mobile
-        ? await this.prisma.person.findFirst({
+      // اگر همان شخص قبلاً به کد دیگری از این اتصال لینک شده، نام و لینک دست نمی‌خورند
+      // تا کد قبلی جابه‌جا نشود و این کد هم مشتری تکراری نسازد.
+      const mobileKeys = phoneIdentityKeys(mobile);
+      const matches = mobileKeys.length
+        ? await this.prisma.person.findMany({
             where: {
               organizationId,
-              OR: [{ mobile }, { phone: mobile }],
-              accountingLinks: { none: { connectionId: dto.connectionId } },
+              OR: [{ mobile: { in: mobileKeys } }, { phone: { in: mobileKeys } }],
             },
+            include: {
+              accountingLinks: {
+                where: { connectionId: dto.connectionId },
+                select: { moshtariCode: true },
+              },
+            },
+            orderBy: { createdAt: 'asc' },
           })
-        : null;
+        : [];
+      const byMobile = matches.find((person) => person.importSource === 'tahesab') ?? matches[0] ?? null;
       if (byMobile) {
+        const linkedCode = byMobile.accountingLinks[0]?.moshtariCode;
+        if (linkedCode != null && linkedCode !== dto.moshtariCode) {
+          const existing = await this.prisma.personAccountingLink.findFirst({
+            where: { personId: byMobile.id, connectionId: dto.connectionId },
+            include: {
+              connection: { select: { label: true, dbName: true, isDefault: true } },
+            },
+          });
+          if (!existing) {
+            throw new NotFoundException('لینک ته‌حساب این مشتری یافت نشد.');
+          }
+          return {
+            personId: byMobile.id,
+            link: this.linkDto(existing),
+            duplicateOf: linkedCode,
+          };
+        }
         const nameChanged =
           `${byMobile.firstName} ${byMobile.lastName}`.trim() !==
           `${firstName} ${lastName}`.trim();
@@ -645,11 +762,17 @@ export class TahesabPersonLinkService {
             ...carryPreviousSource(byMobile, 'tahesab'),
             importSource: 'tahesab',
             sourceRef,
-            ...(!byMobile.birthDate && pickBirthDate(row) ? { birthDate: pickBirthDate(row) } : {}),
+            ...canonicalMobileUpdate(mobile, byMobile),
+            ...tahesabProfilePatch(row, byMobile),
           },
         });
         personId = byMobile.id;
       } else {
+        const profile = tahesabProfilePatch(row, {
+          birthDate: null,
+          addresses: [],
+          customFields: {},
+        });
         const created = await this.prisma.person.create({
           data: {
             organizationId,
@@ -662,7 +785,9 @@ export class TahesabPersonLinkService {
             notes: `واردشده از ته‌حساب (کد ${dto.moshtariCode})`,
             importSource: 'tahesab',
             sourceRef,
-            birthDate: pickBirthDate(row),
+            birthDate: (profile.birthDate as Date | undefined) ?? null,
+            addresses: (profile.addresses as Prisma.InputJsonValue) ?? [],
+            customFields: (profile.customFields as Prisma.InputJsonValue) ?? {},
           },
         });
         personId = created.id;
@@ -693,18 +818,184 @@ export class TahesabPersonLinkService {
     });
     await this.applyTahesabGroup(organizationId, dto.connectionId, personId, row);
 
+    if (!options?.skipJob) {
+      await this.prisma.accountingSyncJob.create({
+        data: {
+          organizationId,
+          connectionId: dto.connectionId,
+          kind: 'import',
+          status: 'success',
+          request: dto as unknown as Prisma.InputJsonValue,
+          result: { personId, linkId: link.id } as Prisma.InputJsonValue,
+        },
+      });
+    }
+
+    return { personId, link: this.linkDto(link) };
+  }
+
+  /** پروفایل و گروه مشتریِ از قبل لینک‌شده را با ردیف ته‌حساب تازه می‌کند. */
+  private async refreshLinkedCustomer(
+    organizationId: string,
+    connectionId: string,
+    personId: string,
+    moshtariCode: number,
+    row: Record<string, unknown>,
+  ) {
+    const existing = await this.getPerson(organizationId, personId);
+    const picked = pickName(row).trim();
+    const named = picked
+      ? applyPersonGenderTitle({ firstName: picked, lastName: '' })
+      : null;
+    const nameChanged =
+      named != null &&
+      namesDiffer(
+        existing.firstName,
+        existing.lastName,
+        named.firstName,
+        named.lastName,
+      );
+    await this.prisma.person.update({
+      where: { id: personId },
+      data: {
+        ...(named
+          ? {
+              firstName: named.firstName,
+              lastName: named.lastName,
+              gender: named.gender,
+              showGenderInName: named.showGenderInName,
+            }
+          : {}),
+        ...(nameChanged
+          ? {
+              previousFirstName: existing.firstName || null,
+              previousLastName: existing.lastName || null,
+            }
+          : {}),
+        ...carryPreviousSource(existing, 'tahesab'),
+        importSource: 'tahesab',
+        sourceRef: String(moshtariCode),
+        ...canonicalMobileUpdate(storedPhoneNumber(pickTel(row)), existing),
+        ...tahesabProfilePatch(row, existing),
+      },
+    });
+    await this.applyTahesabGroup(organizationId, connectionId, personId, row);
+  }
+
+  /**
+   * همهٔ مشتریان ته‌حساب را صفحه به صفحه می‌خواند.
+   * کد تازه وارد می‌شود؛ کد لینک‌شده نام و شماره و گروهش تازه می‌شود.
+   */
+  async syncAllCustomers(organizationId: string, connectionId: string) {
+    const { api } = await this.connections.getApi(organizationId, connectionId);
+    let page = 1;
+    let emptyStreak = 0;
+    let imported = 0;
+    let updated = 0;
+    let duplicate = 0;
+    let failed = 0;
+    const errors: string[] = [];
+    const maxPages = 300;
+
+    while (emptyStreak < 2 && page <= maxPages) {
+      let listed: Awaited<ReturnType<typeof this.listMoshtariPage>>;
+      try {
+        listed = await this.listMoshtariPage(api, page, LIST_PAGE_SIZE);
+      } catch (err) {
+        const message = err instanceof Error ? err.message : 'خواندن ته‌حساب ناموفق بود';
+        errors.push(message);
+        break;
+      }
+      if (!listed.rows.length) {
+        emptyStreak += 1;
+        page += 1;
+        continue;
+      }
+      emptyStreak = 0;
+      const rowsByCode = new Map<number, Record<string, unknown>>();
+      for (const row of listed.rows) {
+        const code = pickCode(row);
+        if (code != null && code >= 1) rowsByCode.set(code, row);
+      }
+      const links = rowsByCode.size
+        ? await this.prisma.personAccountingLink.findMany({
+            where: {
+              connectionId,
+              moshtariCode: { in: [...rowsByCode.keys()] },
+            },
+            select: { moshtariCode: true, personId: true },
+          })
+        : [];
+      const linkedByCode = new Map(links.map((link) => [link.moshtariCode, link.personId]));
+      for (const [code, row] of rowsByCode) {
+        try {
+          const personId = linkedByCode.get(code);
+          if (personId) {
+            await this.refreshLinkedCustomer(
+              organizationId,
+              connectionId,
+              personId,
+              code,
+              row,
+            );
+            updated += 1;
+          } else {
+            const created = await this.importFromTahesab(
+              organizationId,
+              { connectionId, moshtariCode: code },
+              { api, row },
+              { skipJob: true },
+            );
+            if (created.duplicateOf) duplicate += 1;
+            else imported += 1;
+          }
+        } catch (err) {
+          failed += 1;
+          if (errors.length < 5) {
+            errors.push(err instanceof Error ? err.message : 'خطا');
+          }
+        }
+      }
+      page += 1;
+    }
+
+    if (page > maxPages && emptyStreak < 2) {
+      errors.push('فهرست مشتریان از سقف خواندن خودکار بیشتر بود.');
+    }
+
+    const summary = [
+      `${imported} وارد شد`,
+      `${updated} به‌روز شد`,
+      ...(duplicate ? [`${duplicate} شماره تکراری`] : []),
+      `${failed} خطا`,
+    ].join('، ');
+    const error = errors.length ? errors.join('؛ ') : null;
     await this.prisma.accountingSyncJob.create({
       data: {
         organizationId,
-        connectionId: dto.connectionId,
-        kind: 'import',
-        status: 'success',
-        request: dto as unknown as Prisma.InputJsonValue,
-        result: { personId, linkId: link.id } as Prisma.InputJsonValue,
+        connectionId,
+        kind: 'customer-sync',
+        status: !imported && !updated && (failed > 0 || errors.length > 0) ? 'error' : 'success',
+        result: { imported, updated, duplicate, failed, pages: page - 1 } as Prisma.InputJsonValue,
       },
     });
-
-    return { personId, link: this.linkDto(link) };
+    await this.prisma.accountingConnection.update({
+      where: { id: connectionId },
+      data: {
+        customerSyncLastRunAt: new Date(),
+        customerSyncLastSummary: summary,
+        customerSyncLastError: error,
+      },
+    });
+    this.logger.log(`همگام‌سازی مشتریان ته‌حساب ${connectionId}: ${summary}`);
+    return {
+      imported,
+      updated,
+      duplicate,
+      failed,
+      summary,
+      error,
+    };
   }
 
   async importBulk(organizationId: string, dto: ImportBulkFromTahesabDto) {
@@ -799,19 +1090,16 @@ export class TahesabPersonLinkService {
       try {
         const linkedPersonId = linkedByCode.get(moshtariCode);
         if (linkedPersonId) {
-          const birthDate = pickBirthDate(rowsByCode.get(moshtariCode) ?? {});
-          if (birthDate) {
-            await this.prisma.person.updateMany({
-              where: { id: linkedPersonId, birthDate: null },
-              data: { birthDate },
-            });
+          const row = rowsByCode.get(moshtariCode);
+          if (row) {
+            await this.refreshLinkedCustomer(
+              organizationId,
+              dto.connectionId,
+              linkedPersonId,
+              moshtariCode,
+              row,
+            );
           }
-          await this.applyTahesabGroup(
-            organizationId,
-            dto.connectionId,
-            linkedPersonId,
-            rowsByCode.get(moshtariCode),
-          );
           items.push({
             moshtariCode,
             ok: true,
@@ -825,6 +1113,16 @@ export class TahesabPersonLinkService {
           { connectionId: dto.connectionId, moshtariCode },
           bulkApi ? { api: bulkApi, row: rowsByCode.get(moshtariCode) } : undefined,
         );
+        if (r.duplicateOf) {
+          items.push({
+            moshtariCode,
+            ok: true,
+            skipped: true,
+            personId: r.personId,
+            error: `شماره تکراری است و قبلاً با کد ${r.duplicateOf} لینک شده`,
+          });
+          continue;
+        }
         items.push({ moshtariCode, ok: true, personId: r.personId });
       } catch (e) {
         const message =

apps/api/src/integrations/tahesab/tahesab.controller.ts

@@ -37,6 +37,7 @@ import {
   SearchTahesabDto,
   SearchTahesabProductsDto,
   SyncAsnadReportDto,
+  SyncAllCustomersDto,
   SyncGroupsPageDto,
   UpdateTahesabConnectionDto,
   UpdateTahesabInvoiceSettingsDto,
@@ -237,6 +238,16 @@ export class TahesabController {
     return this.links.syncGroupsPage(user.organizationId, dto);
   }
 
+  /** همهٔ مشتریان ته‌حساب: تازه‌ها وارد، لینک‌شده‌ها (نام/موبایل/کدملی/آدرس/شهر/رسته/گروه) به‌روز */
+  @Post('sync/customers-now')
+  @Roles('owner', 'admin')
+  syncCustomersNow(
+    @CurrentUser() user: { organizationId: string },
+    @Body() dto: SyncAllCustomersDto,
+  ) {
+    return this.links.syncAllCustomers(user.organizationId, dto.connectionId);
+  }
+
   @Get('sync/unlinked-people')
   @Roles('owner', 'admin')
   unlinkedPeople(

apps/api/src/integrations/tahesab/tahesab.module.ts

@@ -12,6 +12,7 @@ import { TahesabBalanceService } from './balance.service';
 import { TahesabDocumentsService } from './documents.service';
 import { TahesabAsnadReportService } from './asnad-report.service';
 import { TahesabInvoiceSettingsService } from './invoice-settings.service';
+import { TahesabCustomerSyncScheduler } from './customer-sync.scheduler';
 import { TahesabController } from './tahesab.controller';
 import { CustomerGroupsModule } from '../../customer-groups/customer-groups.module';
 
@@ -29,6 +30,7 @@ import { CustomerGroupsModule } from '../../customer-groups/customer-groups.modu
     TahesabDocumentsService,
     TahesabAsnadReportService,
     TahesabInvoiceSettingsService,
+    TahesabCustomerSyncScheduler,
   ],
   exports: [
     TahesabCryptoService,

apps/api/src/integrations/voip/call-summary.service.ts

@@ -3,6 +3,9 @@ import { Cron } from '@nestjs/schedule';
 import { AiService } from '../../ai/ai.service';
 import { NotesService } from '../../notes/notes.service';
 import { PrismaService } from '../../prisma/prisma.service';
+import { VoipConnectionsService } from './connections.service';
+import { DaftaresomaClient } from './daftareshoma-client';
+import { parseDaftaresomaRecordingRef } from './daftareshoma-webhook';
 import { SttClientService } from './stt-client.service';
 
 const MAX_ATTEMPTS = 3;
@@ -17,6 +20,8 @@ export class CallSummaryService {
     private readonly stt: SttClientService,
     private readonly ai: AiService,
     private readonly notes: NotesService,
+    private readonly connections: VoipConnectionsService,
+    private readonly daftareshoma: DaftaresomaClient,
   ) {}
 
   @Cron('*/1 * * * *')
@@ -74,7 +79,31 @@ export class CallSummaryService {
           );
           return;
         }
-        transcript = await this.stt.downloadAndTranscribe(row.recordingUrl);
+        const daftId = parseDaftaresomaRecordingRef(row.recordingUrl);
+        if (daftId) {
+          const conn = await this.prisma.voipConnection.findFirst({
+            where: { id: row.connectionId },
+          });
+          const token = conn
+            ? await this.connections.decryptApiToken(conn)
+            : null;
+          if (!token) {
+            await this.markFailed(
+              id,
+              row.summaryAttempts,
+              'توکن API دفتر شما برای دانلود ضبط موجود نیست',
+              true,
+            );
+            return;
+          }
+          const audio = await this.daftareshoma.downloadRecording(
+            token,
+            daftId,
+          );
+          transcript = await this.stt.transcribeAudio(audio);
+        } else {
+          transcript = await this.stt.downloadAndTranscribe(row.recordingUrl);
+        }
         await this.prisma.voipCallLog.update({
           where: { id },
           data: { transcript },

apps/api/src/integrations/voip/calls.service.ts

@@ -11,8 +11,13 @@ import type {
 } from '@mento/shared';
 import { PrismaService } from '../../prisma/prisma.service';
 import { NotificationsService } from '../../notifications/notifications.service';
-import { normalizePhone } from '../../contacts/normalize';
+import { iranMobileLookupKeys, normalizePhone } from '../../contacts/normalize';
 import { VoipConnectionsService } from './connections.service';
+import { DaftaresomaClient } from './daftareshoma-client';
+import {
+  daftareshomaRecordingRef,
+  parseDaftaresomaRecordingRef,
+} from './daftareshoma-webhook';
 
 function digitsOnly(value: string | null | undefined): string {
   return (value ?? '').replace(/\D/g, '');
@@ -35,6 +40,7 @@ function phoneVariants(raw: string | null | undefined): string[] {
     variants.add(`0${d}`);
     variants.add(`98${d}`);
   }
+  for (const key of iranMobileLookupKeys(raw)) variants.add(key);
   return [...variants];
 }
 
@@ -56,19 +62,32 @@ export class VoipCallsService {
     private readonly prisma: PrismaService,
     private readonly connections: VoipConnectionsService,
     private readonly notifications: NotificationsService,
+    private readonly daftareshoma: DaftaresomaClient,
   ) {}
 
   async listRecent(
     organizationId: string,
-    connectionId?: string,
+    opts?: {
+      connectionId?: string;
+      direction?: string;
+      status?: string;
+      lineExtension?: string;
+    },
   ): Promise<VoipCallLogDto[]> {
     const rows = await this.prisma.voipCallLog.findMany({
       where: {
         organizationId,
-        ...(connectionId ? { connectionId } : {}),
+        ...(opts?.connectionId ? { connectionId: opts.connectionId } : {}),
+        ...(opts?.direction === 'inbound' || opts?.direction === 'outbound'
+          ? { direction: opts.direction }
+          : {}),
+        ...(opts?.status?.trim() ? { status: opts.status.trim() } : {}),
+        ...(opts?.lineExtension?.trim()
+          ? { lineExtension: opts.lineExtension.trim() }
+          : {}),
       },
       orderBy: { syncedAt: 'desc' },
-      take: 50,
+      take: 100,
     });
     const personIds = rows
       .map((r) => r.personId)
@@ -90,6 +109,7 @@ export class VoipCallsService {
       status: r.status,
       fromNumber: r.fromNumber,
       toNumber: r.toNumber,
+      lineExtension: r.lineExtension ?? null,
       personId: r.personId,
       personName: r.personId ? (nameById.get(r.personId) ?? null) : null,
       activityId: r.activityId,
@@ -126,6 +146,9 @@ export class VoipCallsService {
     const toDigits = digitsOnly(event.to ?? event.callee);
     const fromNumber = fromNormalized || fromDigits || null;
     const toNumber = toNormalized || toDigits || null;
+    const lineRaw = String(event.lineExtension ?? '').trim();
+    const lineExtension =
+      normalizePhone(lineRaw) || digitsOnly(lineRaw) || lineRaw || null;
     const matchNumber = direction === 'inbound' ? fromNumber : toNumber;
     const personId = await this.findPersonId(
       conn.organizationId,
@@ -192,6 +215,7 @@ export class VoipCallsService {
           status,
           fromNumber,
           toNumber,
+          lineExtension: lineExtension ?? existing.lineExtension,
           personId: personId ?? existing.personId,
           activityId: activityId ?? existing.activityId,
           durationSec,
@@ -212,6 +236,7 @@ export class VoipCallsService {
           status,
           fromNumber,
           toNumber,
+          lineExtension,
           personId,
           activityId,
           durationSec,
@@ -239,6 +264,17 @@ export class VoipCallsService {
       await this.notifyIncoming(conn.organizationId, personId, fromNumber);
     }
 
+    if (
+      conn.provider === 'daftareshoma' &&
+      ['completed', 'answered', 'missed'].includes(status)
+    ) {
+      void this.enrichDaftaresomaRecording(connectionId, callId).catch((e) => {
+        this.logger.warn(
+          `daftareshoma recording enrich failed: ${e instanceof Error ? e.message : e}`,
+        );
+      });
+    }
+
     const link = await this.prisma.voipCallLog.findUnique({
       where: {
         connectionId_externalCallId: {
@@ -260,10 +296,67 @@ export class VoipCallsService {
     userId: string,
     number: string,
     personId?: string,
-  ): Promise<{ ok: true; mode: 'url' | 'tel'; dialUrl: string }> {
+  ): Promise<{ ok: true; mode: 'url' | 'tel' | 'daftareshoma'; dialUrl: string }> {
     const phone = normalizePhone(number) ?? digitsOnly(number);
     if (!phone) throw new BadRequestException('شماره معتبر نیست');
 
+    const daftareshomaConn = await this.prisma.voipConnection.findFirst({
+      where: {
+        organizationId,
+        enabled: true,
+        provider: 'daftareshoma',
+      },
+      orderBy: { createdAt: 'asc' },
+    });
+
+    if (daftareshomaConn) {
+      const token = await this.connections.decryptApiToken(daftareshomaConn);
+      const fromNumber = daftareshomaConn.fromNumber?.trim();
+      const callerExtension = daftareshomaConn.callerExtension?.trim();
+      if (!token || !fromNumber || !callerExtension) {
+        throw new BadRequestException(
+          'اتصال دفتر شما ناقص است؛ توکن، شماره مبدأ و خط را تکمیل کنید',
+        );
+      }
+      const toE164 = this.toPlusDigits(phone);
+      const fromE164 = this.toPlusDigits(fromNumber);
+      const extE164 = this.toPlusDigits(callerExtension);
+      try {
+        await this.daftareshoma.outgoingCall(token, {
+          fromNumber: fromE164,
+          toNumber: toE164,
+          callerExtension: extE164,
+        });
+      } catch (e) {
+        const msg = e instanceof Error ? e.message : 'خطا';
+        await this.prisma.voipConnection.update({
+          where: { id: daftareshomaConn.id },
+          data: { lastError: msg.slice(0, 400) },
+        });
+        throw new BadRequestException(msg);
+      }
+
+      await this.prisma.voipCallLog.create({
+        data: {
+          organizationId,
+          connectionId: daftareshomaConn.id,
+          externalCallId: `ctc-${Date.now()}-${userId.slice(0, 6)}`,
+          direction: 'outbound',
+          status: 'ringing',
+          fromNumber: fromE164,
+          toNumber: toE164,
+          personId: personId ?? null,
+          startedAt: new Date(),
+        },
+      });
+
+      return {
+        ok: true,
+        mode: 'daftareshoma',
+        dialUrl: `daftareshoma:${toE164}`,
+      };
+    }
+
     const conn = await this.prisma.voipConnection.findFirst({
       where: {
         organizationId,
@@ -317,6 +410,69 @@ export class VoipCallsService {
     return { ok: true, mode: 'tel', dialUrl: `tel:${phone}` };
   }
 
+  private toPlusDigits(raw: string): string {
+    const d = digitsOnly(raw);
+    if (!d) return raw.trim();
+    if (raw.trim().startsWith('+')) return `+${d}`;
+    if (d.startsWith('98')) return `+${d}`;
+    if (d.startsWith('0') && d.length >= 10) return `+98${d.slice(1)}`;
+    if (d.length === 10 && d.startsWith('9')) return `+98${d}`;
+    return `+${d}`;
+  }
+
+  private async enrichDaftaresomaRecording(
+    connectionId: string,
+    callId: string,
+  ): Promise<void> {
+    const conn = await this.prisma.voipConnection.findFirst({
+      where: { id: connectionId, provider: 'daftareshoma', enabled: true },
+    });
+    if (!conn) return;
+    const log = await this.prisma.voipCallLog.findUnique({
+      where: {
+        connectionId_externalCallId: { connectionId, externalCallId: callId },
+      },
+    });
+    if (!log) return;
+    if (parseDaftaresomaRecordingRef(log.recordingUrl) || log.recordingUrl) {
+      if (
+        parseDaftaresomaRecordingRef(log.recordingUrl) &&
+        !['done', 'pending', 'processing'].includes(log.summaryStatus)
+      ) {
+        await this.prisma.voipCallLog.update({
+          where: { id: log.id },
+          data: {
+            summaryStatus: 'pending',
+            summaryError: null,
+            summaryNextAttemptAt: new Date(),
+          },
+        });
+      }
+      return;
+    }
+
+    const token = await this.connections.decryptApiToken(conn);
+    if (!token) return;
+    const row = await this.daftareshoma.findCallById(token, callId);
+    const recordingId = row?.recordingId?.trim();
+    if (!recordingId) return;
+
+    const ref = daftareshomaRecordingRef(recordingId);
+    await this.prisma.voipCallLog.update({
+      where: { id: log.id },
+      data: {
+        recordingUrl: ref,
+        summaryStatus: ['done', 'pending', 'processing'].includes(
+          log.summaryStatus,
+        )
+          ? log.summaryStatus
+          : 'pending',
+        summaryError: null,
+        summaryNextAttemptAt: new Date(),
+      },
+    });
+  }
+
   private shouldCreateActivity(status: string): boolean {
     return ['answered', 'completed', 'missed', 'failed'].includes(status);
   }

apps/api/src/integrations/voip/connections.service.ts

@@ -7,12 +7,17 @@ import type {
   CreateVoipConnectionRequest,
   UpdateVoipConnectionRequest,
   VoipConnectionDto,
+  VoipProvider,
 } from '@mento/shared';
 import { Prisma } from '@prisma/client';
 import { createHmac } from 'crypto';
 import { PrismaService } from '../../prisma/prisma.service';
 import { TahesabCryptoService } from '../tahesab/tahesab-crypto.service';
 
+function asProvider(value: string | null | undefined): VoipProvider {
+  return value === 'daftareshoma' ? 'daftareshoma' : 'generic';
+}
+
 @Injectable()
 export class VoipConnectionsService {
   constructor(
@@ -43,19 +48,35 @@ export class VoipConnectionsService {
   ): Promise<VoipConnectionDto> {
     const label = dto.label?.trim();
     if (!label) throw new BadRequestException('نام اتصال الزامی است');
+    const provider = asProvider(dto.provider);
+    if (provider === 'daftareshoma') {
+      const token = dto.apiToken?.trim();
+      if (!token) throw new BadRequestException('توکن API دفتر شما الزامی است');
+      // fromNumber / callerExtension فقط برای تماس خروجی از CRM لازم‌اند؛ ثبت وب‌هوک بدون آن‌ها ممکن است
+    }
+
     const secret = dto.webhookSecret?.trim();
     const secretEnc = secret ? this.crypto.encrypt(secret) : null;
-    const clickToCallUrl = this.normalizeClickUrl(dto.clickToCallUrl);
+    const token = dto.apiToken?.trim();
+    const tokenEnc = token ? this.crypto.encrypt(token) : null;
+    const clickToCallUrl =
+      provider === 'generic' ? this.normalizeClickUrl(dto.clickToCallUrl) : null;
 
     const row = await this.prisma.voipConnection.create({
       data: {
         organizationId,
         label,
+        provider,
         enabled: dto.enabled ?? true,
         clickToCallUrl,
+        fromNumber: dto.fromNumber?.trim() || null,
+        callerExtension: dto.callerExtension?.trim() || null,
         webhookSecretCiphertext: secretEnc?.ciphertext,
         webhookSecretIv: secretEnc?.iv,
         webhookSecretTag: secretEnc?.tag,
+        apiTokenCiphertext: tokenEnc?.ciphertext,
+        apiTokenIv: tokenEnc?.iv,
+        apiTokenTag: tokenEnc?.tag,
       },
     });
     return this.toDto(row, 0);
@@ -77,6 +98,12 @@ export class VoipConnectionsService {
     if (dto.clickToCallUrl !== undefined) {
       data.clickToCallUrl = this.normalizeClickUrl(dto.clickToCallUrl);
     }
+    if (dto.fromNumber !== undefined) {
+      data.fromNumber = dto.fromNumber?.trim() || null;
+    }
+    if (dto.callerExtension !== undefined) {
+      data.callerExtension = dto.callerExtension?.trim() || null;
+    }
     if (dto.webhookSecret !== undefined) {
       const wh = dto.webhookSecret?.trim();
       if (!wh) {
@@ -90,6 +117,19 @@ export class VoipConnectionsService {
         data.webhookSecretTag = enc.tag;
       }
     }
+    if (dto.apiToken !== undefined) {
+      const tok = dto.apiToken?.trim();
+      if (!tok) {
+        data.apiTokenCiphertext = null;
+        data.apiTokenIv = null;
+        data.apiTokenTag = null;
+      } else {
+        const enc = this.crypto.encrypt(tok);
+        data.apiTokenCiphertext = enc.ciphertext;
+        data.apiTokenIv = enc.iv;
+        data.apiTokenTag = enc.tag;
+      }
+    }
     const row = await this.prisma.voipConnection.update({
       where: { id: existing.id },
       data,
@@ -124,6 +164,21 @@ export class VoipConnectionsService {
     });
   }
 
+  async decryptApiToken(row: {
+    apiTokenCiphertext: string | null;
+    apiTokenIv: string | null;
+    apiTokenTag: string | null;
+  }): Promise<string | null> {
+    if (!row.apiTokenCiphertext || !row.apiTokenIv || !row.apiTokenTag) {
+      return null;
+    }
+    return this.crypto.decrypt({
+      ciphertext: row.apiTokenCiphertext,
+      iv: row.apiTokenIv,
+      tag: row.apiTokenTag,
+    });
+  }
+
   verifySignature(
     rawBody: string | Buffer,
     signature: string | undefined,
@@ -153,9 +208,13 @@ export class VoipConnectionsService {
     row: {
       id: string;
       label: string;
+      provider?: string | null;
       enabled: boolean;
       webhookSecretCiphertext: string | null;
+      apiTokenCiphertext?: string | null;
       clickToCallUrl: string | null;
+      fromNumber?: string | null;
+      callerExtension?: string | null;
       lastEventAt: Date | null;
       lastError: string | null;
       createdAt: Date;
@@ -166,9 +225,13 @@ export class VoipConnectionsService {
     return {
       id: row.id,
       label: row.label,
+      provider: asProvider(row.provider),
       enabled: row.enabled,
       webhookSecretSet: Boolean(row.webhookSecretCiphertext),
+      apiTokenSet: Boolean(row.apiTokenCiphertext),
       clickToCallUrl: row.clickToCallUrl,
+      fromNumber: row.fromNumber ?? null,
+      callerExtension: row.callerExtension ?? null,
       lastEventAt: row.lastEventAt?.toISOString() ?? null,
       lastError: row.lastError,
       callCount,

apps/api/src/integrations/voip/daftareshoma-client.ts

@@ -0,0 +1,126 @@
+import { Injectable, Logger } from '@nestjs/common';
+
+const BASE_URL = 'https://coreapi.daftareshoma.com/api/Customize';
+const MAX_AUDIO_BYTES = 8 * 1024 * 1024;
+
+export type DaftaresomaOutgoingCallInput = {
+  fromNumber: string;
+  toNumber: string;
+  callerExtension: string;
+};
+
+export type DaftaresomaCallSearchRow = {
+  id?: string;
+  fromNumber?: string;
+  toNumber?: string;
+  recordingId?: string | null;
+  direction?: string;
+  reportDispositionType?: string;
+  startTime?: string;
+  endTime?: string;
+  duration?: string;
+  extension?: string;
+};
+
+@Injectable()
+export class DaftaresomaClient {
+  private readonly logger = new Logger(DaftaresomaClient.name);
+
+  async outgoingCall(
+    apiToken: string,
+    input: DaftaresomaOutgoingCallInput,
+  ): Promise<void> {
+    const res = await fetch(`${BASE_URL}/OutgoingCall`, {
+      method: 'POST',
+      headers: {
+        Authorization: `Bearer ${apiToken}`,
+        'Content-Type': 'application/json',
+        Accept: 'application/json',
+      },
+      body: JSON.stringify({
+        from_number: input.fromNumber,
+        to_number: input.toNumber,
+        caller_extension: input.callerExtension,
+      }),
+      signal: AbortSignal.timeout(15000),
+    });
+    if (!res.ok) {
+      const text = await res.text().catch(() => '');
+      this.logger.warn(
+        `OutgoingCall failed (${res.status}): ${text.slice(0, 300)}`,
+      );
+      throw new Error(
+        text.trim()
+          ? `تماس خروجی دفتر شما ناموفق بود (${res.status}): ${text.slice(0, 200)}`
+          : `تماس خروجی دفتر شما ناموفق بود (${res.status})`,
+      );
+    }
+  }
+
+  async findCallById(
+    apiToken: string,
+    callId: string,
+  ): Promise<DaftaresomaCallSearchRow | null> {
+    const res = await fetch(`${BASE_URL}/CustomerCallSearch`, {
+      method: 'POST',
+      headers: {
+        Authorization: `Bearer ${apiToken}`,
+        'Content-Type': 'application/json',
+        Accept: 'application/json',
+      },
+      body: JSON.stringify({ id: callId, limit: 1, pagination: 1 }),
+      signal: AbortSignal.timeout(20000),
+    });
+    if (!res.ok) {
+      const text = await res.text().catch(() => '');
+      this.logger.warn(
+        `CustomerCallSearch failed (${res.status}): ${text.slice(0, 200)}`,
+      );
+      return null;
+    }
+    const json = (await res.json()) as {
+      data?: DaftaresomaCallSearchRow[];
+    };
+    const row = Array.isArray(json.data) ? json.data[0] : null;
+    return row ?? null;
+  }
+
+  async downloadRecording(
+    apiToken: string,
+    recordingId: string,
+  ): Promise<{ buffer: ArrayBuffer; contentType: string; filename: string }> {
+    const url = new URL(`${BASE_URL}/GetCallRecording`);
+    url.searchParams.set('recordingId', recordingId);
+    const res = await fetch(url.toString(), {
+      method: 'GET',
+      headers: {
+        Authorization: `Bearer ${apiToken}`,
+        Accept: '*/*',
+        'User-Agent': 'MontactCRM-VoIP/1.0',
+      },
+      signal: AbortSignal.timeout(60000),
+      redirect: 'follow',
+    });
+    if (!res.ok) {
+      const text = await res.text().catch(() => '');
+      throw new Error(
+        `دانلود ضبط دفتر شما ناموفق بود (${res.status})${text ? `: ${text.slice(0, 160)}` : ''}`,
+      );
+    }
+    const contentLength = Number(res.headers.get('content-length') || 0);
+    if (contentLength > MAX_AUDIO_BYTES) {
+      throw new Error('حجم فایل ضبط بیش از حد مجاز است');
+    }
+    const buffer = await res.arrayBuffer();
+    if (buffer.byteLength > MAX_AUDIO_BYTES) {
+      throw new Error('حجم فایل ضبط بیش از حد مجاز است');
+    }
+    if (!buffer.byteLength) {
+      throw new Error('فایل ضبط خالی است');
+    }
+    const contentType =
+      res.headers.get('content-type')?.split(';')[0]?.trim() || 'audio/wav';
+    const filename = `daftareshoma-${recordingId}.wav`;
+    return { buffer, contentType, filename };
+  }
+}

apps/api/src/integrations/voip/daftareshoma-webhook.ts

@@ -0,0 +1,168 @@
+import type { VoipWebhookEvent } from '@mento/shared';
+
+/** پیشوند ذخیره‌شده در recordingUrl برای واکشی بعدی با توکن API */
+export const DAFTARESHOMA_RECORDING_PREFIX = 'daftareshoma-recording:';
+
+export function daftareshomaRecordingRef(recordingId: string): string {
+  return `${DAFTARESHOMA_RECORDING_PREFIX}${recordingId}`;
+}
+
+export function parseDaftaresomaRecordingRef(
+  value: string | null | undefined,
+): string | null {
+  const raw = String(value ?? '').trim();
+  if (!raw.startsWith(DAFTARESHOMA_RECORDING_PREFIX)) return null;
+  const id = raw.slice(DAFTARESHOMA_RECORDING_PREFIX.length).trim();
+  return id || null;
+}
+
+type Loose = Record<string, unknown>;
+
+function str(v: unknown): string {
+  return v == null ? '' : String(v).trim();
+}
+
+function pick(obj: Loose, ...keys: string[]): string {
+  for (const k of keys) {
+    const v = str(obj[k]);
+    if (v) return v;
+  }
+  return '';
+}
+
+function parseDurationSec(raw: unknown): number | undefined {
+  if (raw == null || raw === '') return undefined;
+  if (typeof raw === 'number' && Number.isFinite(raw)) {
+    return Math.max(0, Math.round(raw));
+  }
+  const s = String(raw).trim();
+  if (!s) return undefined;
+  if (/^\d+(\.\d+)?$/.test(s)) return Math.max(0, Math.round(Number(s)));
+  const parts = s.split(':').map((p) => Number(p));
+  if (parts.some((n) => !Number.isFinite(n))) return undefined;
+  if (parts.length === 3) {
+    return Math.max(0, Math.round(parts[0]! * 3600 + parts[1]! * 60 + parts[2]!));
+  }
+  if (parts.length === 2) {
+    return Math.max(0, Math.round(parts[0]! * 60 + parts[1]!));
+  }
+  return undefined;
+}
+
+/**
+ * رویداد وب‌هوک دفتر شما را به VoipWebhookEvent تبدیل می‌کند.
+ * اگر payload از قبل فرمت Montact باشد، همان را برمی‌گرداند.
+ */
+export function mapDaftaresomaWebhook(
+  body: unknown,
+): VoipWebhookEvent | null {
+  if (!body || typeof body !== 'object') return null;
+  const obj = body as Loose;
+
+  const legacyCallId = pick(obj, 'callId');
+  if (legacyCallId && (obj.direction || obj.status || obj.from || obj.to)) {
+    return body as VoipWebhookEvent;
+  }
+
+  const eventType = pick(obj, 'EventType', 'eventType', 'event');
+  const callId = pick(obj, 'CallId', 'callId', 'Id', 'id');
+  if (!callId) return null;
+
+  const caller = pick(
+    obj,
+    'CallerNumber',
+    'callerNumber',
+    'from',
+    'From',
+    'fromNumber',
+  );
+  /** خط سازمانی که تماس روی آن آمده/رفته */
+  const lineExtension =
+    pick(obj, 'CalleeExtension', 'calleeExtension', 'Extension', 'extension') ||
+    undefined;
+  /** مقصد انتقال / شماره طرف مقابل روی خط */
+  const transferred = pick(
+    obj,
+    'TransferredToNumber',
+    'transferredToNumber',
+  );
+
+  const startedAt =
+    pick(obj, 'StartDateTime', 'startDateTime', 'startedAt') || undefined;
+  const endedAt =
+    pick(obj, 'EndDateTime', 'endDateTime', 'endedAt', 'DateTime') ||
+    undefined;
+  const durationSec = parseDurationSec(
+    obj.DurationInSeconds ?? obj.durationInSeconds ?? obj.durationSec,
+  );
+
+  const lower = eventType.toLowerCase();
+  const isOutbound = lower.includes('outgoing') || lower.includes('outbound');
+  const isStarted =
+    lower.includes('started') ||
+    lower.includes('ringing') ||
+    lower.includes('transferstarted');
+  const isEnded =
+    lower.includes('ended') ||
+    lower.includes('completed') ||
+    lower.includes('hangup');
+
+  let status: string = 'completed';
+  if (isStarted && !isEnded) {
+    status = 'ringing';
+  } else if (isEnded) {
+    const result = obj.Result ?? obj.result;
+    if (result === false || result === 'false' || result === 0) {
+      status = durationSec && durationSec > 0 ? 'completed' : 'missed';
+    } else if (result === true || result === 'true' || result === 1) {
+      status = 'completed';
+    } else {
+      status = 'completed';
+    }
+  }
+
+  const recordingId = pick(
+    obj,
+    'RecordingId',
+    'recordingId',
+    'RecordId',
+    'recordId',
+  );
+
+  // inbound: from=مشتری، to=همکار/مقصد انتقال یا خود خط
+  // outbound: from=همکار، to=مشتری (TransferredToNumber)
+  let from = caller || undefined;
+  let to: string | undefined;
+  if (isOutbound) {
+    to = transferred || undefined;
+  } else {
+    to = transferred || lineExtension || undefined;
+  }
+
+  const event: VoipWebhookEvent = {
+    callId,
+    direction: isOutbound ? 'outbound' : 'inbound',
+    status,
+    from,
+    to,
+    lineExtension,
+    startedAt,
+    endedAt,
+    durationSec,
+    caller: from,
+    callee: to,
+  };
+  if (recordingId) {
+    event.recordingUrl = daftareshomaRecordingRef(recordingId);
+  }
+  return event;
+}
+
+export function isDaftaresomaWebhookPayload(body: unknown): boolean {
+  if (!body || typeof body !== 'object') return false;
+  const obj = body as Loose;
+  return Boolean(
+    pick(obj, 'EventType', 'eventType') ||
+      (pick(obj, 'CallId') && pick(obj, 'CallerNumber', 'callerNumber')),
+  );
+}

apps/api/src/integrations/voip/dto.ts

@@ -1,5 +1,6 @@
 import {
   IsBoolean,
+  IsIn,
   IsOptional,
   IsString,
   MaxLength,
@@ -12,6 +13,10 @@ export class CreateVoipConnectionDto {
   @MaxLength(80)
   label!: string;
 
+  @IsOptional()
+  @IsIn(['generic', 'daftareshoma'])
+  provider?: 'generic' | 'daftareshoma';
+
   @IsOptional()
   @IsString()
   @MaxLength(200)
@@ -22,6 +27,21 @@ export class CreateVoipConnectionDto {
   @MaxLength(500)
   clickToCallUrl?: string | null;
 
+  @IsOptional()
+  @IsString()
+  @MaxLength(500)
+  apiToken?: string;
+
+  @IsOptional()
+  @IsString()
+  @MaxLength(40)
+  fromNumber?: string | null;
+
+  @IsOptional()
+  @IsString()
+  @MaxLength(40)
+  callerExtension?: string | null;
+
   @IsOptional()
   @IsBoolean()
   enabled?: boolean;
@@ -44,6 +64,21 @@ export class UpdateVoipConnectionDto {
   @MaxLength(500)
   clickToCallUrl?: string | null;
 
+  @IsOptional()
+  @IsString()
+  @MaxLength(500)
+  apiToken?: string | null;
+
+  @IsOptional()
+  @IsString()
+  @MaxLength(40)
+  fromNumber?: string | null;
+
+  @IsOptional()
+  @IsString()
+  @MaxLength(40)
+  callerExtension?: string | null;
+
   @IsOptional()
   @IsBoolean()
   enabled?: boolean;

apps/api/src/integrations/voip/stt-client.service.ts

@@ -18,17 +18,31 @@ export class SttClientService {
       throw new ServiceUnavailableException('سرویس تبدیل گفتار فعال نیست');
     }
 
+    const timeoutMs = Number(
+      this.config.get<string>('STT_TIMEOUT_MS') || 180000,
+    );
+    const audio = await this.downloadAudio(recordingUrl, timeoutMs);
+    return this.transcribeAudio(audio, timeoutMs);
+  }
+
+  async transcribeAudio(
+    audio: { buffer: ArrayBuffer; contentType: string; filename: string },
+    timeoutMs?: number,
+  ): Promise<string> {
+    if (!this.isEnabled()) {
+      throw new ServiceUnavailableException('سرویس تبدیل گفتار فعال نیست');
+    }
+
     const baseUrl = this.config.get<string>('STT_URL')?.trim();
     if (!baseUrl) {
       throw new ServiceUnavailableException('آدرس سرویس STT تنظیم نشده');
     }
 
-    const timeoutMs = Number(
+    const waitMs = timeoutMs ?? Number(
       this.config.get<string>('STT_TIMEOUT_MS') || 180000,
     );
     const token = this.config.get<string>('STT_INTERNAL_TOKEN')?.trim() || '';
 
-    const audio = await this.downloadAudio(recordingUrl, timeoutMs);
     const form = new FormData();
     const blob = new Blob([new Uint8Array(audio.buffer)], {
       type: audio.contentType,
@@ -39,7 +53,7 @@ export class SttClientService {
     if (token) headers['X-STT-Token'] = token;
 
     const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    const timer = setTimeout(() => controller.abort(), waitMs);
     try {
       const res = await fetch(`${baseUrl.replace(/\/$/, '')}/transcribe`, {
         method: 'POST',

apps/api/src/integrations/voip/voip.controller.ts

@@ -28,6 +28,10 @@ import {
   UpdateVoipConnectionDto,
   VoipClickToCallDto,
 } from './dto';
+import {
+  isDaftaresomaWebhookPayload,
+  mapDaftaresomaWebhook,
+} from './daftareshoma-webhook';
 
 @Controller('integrations/voip')
 @UseGuards(JwtAuthGuard, RolesGuard, OrgModuleGuard)
@@ -78,8 +82,16 @@ export class VoipController {
   recent(
     @CurrentUser() user: { organizationId: string },
     @Query('connectionId') connectionId?: string,
+    @Query('direction') direction?: string,
+    @Query('status') status?: string,
+    @Query('lineExtension') lineExtension?: string,
   ) {
-    return this.calls.listRecent(user.organizationId, connectionId);
+    return this.calls.listRecent(user.organizationId, {
+      connectionId,
+      direction,
+      status,
+      lineExtension,
+    });
   }
 
   @Post('click-to-call')
@@ -129,11 +141,21 @@ export class VoipWebhookController {
       if (!ok) throw new UnauthorizedException('امضای وب‌هوک نامعتبر است');
     }
 
-    if (!body?.callId) {
+    let event: VoipWebhookEvent | null = null;
+    if (
+      row.provider === 'daftareshoma' ||
+      isDaftaresomaWebhookPayload(body)
+    ) {
+      event = mapDaftaresomaWebhook(body);
+    } else if (body?.callId) {
+      event = body;
+    }
+
+    if (!event?.callId) {
       return { ok: false, error: 'callId required' };
     }
 
-    const result = await this.calls.ingestWebhook(connectionId, body);
+    const result = await this.calls.ingestWebhook(connectionId, event);
     return { ok: true, ...result };
   }
 }

apps/api/src/integrations/voip/voip.module.ts

@@ -7,6 +7,7 @@ import { TahesabCryptoService } from '../tahesab/tahesab-crypto.service';
 import { CallSummaryService } from './call-summary.service';
 import { VoipConnectionsService } from './connections.service';
 import { VoipCallsService } from './calls.service';
+import { DaftaresomaClient } from './daftareshoma-client';
 import { SttClientService } from './stt-client.service';
 import { VoipController, VoipWebhookController } from './voip.controller';
 
@@ -17,6 +18,7 @@ import { VoipController, VoipWebhookController } from './voip.controller';
     TahesabCryptoService,
     VoipConnectionsService,
     VoipCallsService,
+    DaftaresomaClient,
     SttClientService,
     CallSummaryService,
   ],

apps/api/src/integrations/woocommerce/sync.service.ts

@@ -6,7 +6,11 @@ import type {
   WooCommerceSyncResultDto,
 } from '@mento/shared';
 import { PrismaService } from '../../prisma/prisma.service';
-import { normalizeEmail, normalizePhone } from '../../contacts/normalize';
+import {
+  normalizeEmail,
+  phoneIdentityKeys,
+  storedPhoneNumber,
+} from '../../contacts/normalize';
 import { WooConnectionsService } from './connections.service';
 import type { WooOrder } from './woo-client';
 
@@ -374,7 +378,8 @@ export class WooSyncService {
   ): Promise<string | null> {
     const billing = order.billing ?? {};
     const email = normalizeEmail(billing.email ?? null);
-    const mobile = normalizePhone(billing.phone ?? null);
+    const mobile = storedPhoneNumber(billing.phone ?? null);
+    const mobileKeys = phoneIdentityKeys(mobile);
     const firstName = (billing.first_name ?? '').trim() || 'مشتری';
     const lastName = (billing.last_name ?? '').trim() || 'ووکامرس';
 
@@ -387,7 +392,9 @@ export class WooSyncService {
         organizationId,
         OR: [
           ...(email ? [{ email }] : []),
-          ...(mobile ? [{ mobile }, { phone: mobile }] : []),
+          ...(mobileKeys.length
+            ? [{ mobile: { in: mobileKeys } }, { phone: { in: mobileKeys } }]
+            : []),
         ],
       },
       select: { id: true },

apps/api/src/lead-forms/lead-forms.service.ts

@@ -21,9 +21,12 @@ import { StorageQuotaService } from '../billing/storage-quota.service';
 import { AutomationsService } from '../automations/automations.service';
 import { MessageAutomationsService } from '../message-automations/message-automations.service';
 import {
+  canonicalIranMobile,
   emptyToNull,
   normalizeEmail,
   normalizePhone,
+  phoneIdentityKeys,
+  storedPhoneNumber,
 } from '../contacts/normalize';
 import { LeadStagesService } from '../leads/lead-stages.service';
 
@@ -458,7 +461,10 @@ export class LeadFormsService {
       ? await this.prisma.person.findFirst({
           where: {
             organizationId: form.organizationId,
-            OR: [{ mobile }, { phone: mobile }],
+            OR: [
+              { mobile: { in: phoneIdentityKeys(mobile) } },
+              { phone: { in: phoneIdentityKeys(mobile) } },
+            ],
           },
           select: { id: true, firstName: true, lastName: true },
         })
@@ -641,13 +647,16 @@ export class LeadFormsService {
     ownerId: string,
   ): Promise<string> {
     const email = normalizeEmail(mapped.email);
-    const mobile = normalizePhone(mapped.mobile);
-    const phone = normalizePhone(mapped.phone);
+    const mobile = storedPhoneNumber(mapped.mobile);
+    const phone = storedPhoneNumber(mapped.phone);
 
     const or: Prisma.PersonWhereInput[] = [];
     if (email) or.push({ email });
-    if (mobile) or.push({ mobile });
 
+    const mobileKeys = phoneIdentityKeys(mobile);
+    if (mobileKeys.length) {
+      or.push({ mobile: { in: mobileKeys } }, { phone: { in: mobileKeys } });
+    }
     const existing = or.length
       ? await this.prisma.person.findFirst({
           where: { organizationId, OR: or },
@@ -1115,13 +1124,12 @@ function slugKey(label: string): string {
 }
 
 function mobileKey(raw: string | null | undefined): string | null {
+  const canon = canonicalIranMobile(raw);
+  if (canon) return canon;
   const n = normalizePhone(raw);
   if (!n) return null;
   const d = n.replace(/\D/g, '');
-  if (!d) return null;
-  if (d.startsWith('98') && d.length >= 12) return `0${d.slice(2)}`;
-  if (d.length === 10 && d.startsWith('9')) return `0${d}`;
-  return d.startsWith('0') ? d : d;
+  return d || null;
 }
 
 function normalizeDuplicateMode(raw?: string | null): string {

apps/api/src/leads/leads.controller.ts

@@ -246,7 +246,11 @@ export class LeadsController {
     @Query('source') source?: string,
     @Query('unassigned') unassigned?: string,
     @Query('archived') archived?: string,
+    @Query('converted') converted?: string,
     @Query('hasMobile') hasMobile?: string,
+    @Query('followUp') followUp?: string,
+    @Query('createdFrom') createdFrom?: string,
+    @Query('createdTo') createdTo?: string,
   ) {
     return this.leads.listIds(user, {
       q,
@@ -258,7 +262,11 @@ export class LeadsController {
       source,
       unassigned: unassigned === '1' || unassigned === 'true',
       archived: archived === '1' || archived === 'true',
+      converted: converted === '1' || converted === 'true',
       hasMobile: hasMobile === '1' || hasMobile === 'true',
+      followUp,
+      createdFrom,
+      createdTo,
     });
   }
 
@@ -276,8 +284,12 @@ export class LeadsController {
     @Query('source') source?: string,
     @Query('unassigned') unassigned?: string,
     @Query('archived') archived?: string,
+    @Query('converted') converted?: string,
     @Query('sort') sort?: string,
     @Query('hasMobile') hasMobile?: string,
+    @Query('followUp') followUp?: string,
+    @Query('createdFrom') createdFrom?: string,
+    @Query('createdTo') createdTo?: string,
   ) {
     return this.leads.list(user, {
       q,
@@ -291,8 +303,12 @@ export class LeadsController {
       source,
       unassigned: unassigned === '1' || unassigned === 'true',
       archived: archived === '1' || archived === 'true',
+      converted: converted === '1' || converted === 'true',
       sort,
       hasMobile: hasMobile === '1' || hasMobile === 'true',
+      followUp,
+      createdFrom,
+      createdTo,
     });
   }
 

apps/api/src/leads/leads.service.ts

@@ -32,17 +32,29 @@ import {
   forScope,
 } from '../common/record-scope';
 import { actorCanAssignToOthers, assertAssigneeSet } from '../common/assign-access';
+import { placeId, sameIds, writePositions } from '../common/column-order';
 import {
   asAddresses,
   collectAddresses,
   toJsonAddresses,
 } from '../common/custom-fields';
-import { emptyToNull, normalizePhone } from '../contacts/normalize';
+import {
+  canonicalIranMobile,
+  emptyToNull,
+  normalizePhone,
+  phoneIdentityKeys,
+} from '../contacts/normalize';
 import { LocalFileStorage } from '../storage/local-file.storage';
 import { StorageQuotaService } from '../billing/storage-quota.service';
 import { LeadStagesService } from './lead-stages.service';
 import { buildSearchWhere, ci } from '../common/search';
 import { GamificationService } from '../gamification/gamification.service';
+import {
+  addDays,
+  isDayKey,
+  tehranDayKey,
+  tehranDayStart,
+} from '../routines/routine-dates';
 
 const LOGO_MAX_BYTES = 2 * 1024 * 1024;
 const LOGO_EXT: Record<string, string> = {
@@ -54,13 +66,20 @@ const LOGO_EXT: Record<string, string> = {
 };
 
 function mobileKey(raw: string | null | undefined): string | null {
+  const canon = canonicalIranMobile(raw);
+  if (canon) return canon;
   const n = normalizePhone(raw);
   if (!n) return null;
   const d = n.replace(/\D/g, '');
-  if (!d) return null;
-  if (d.startsWith('98') && d.length >= 12) return `0${d.slice(2)}`;
-  if (d.length === 10 && d.startsWith('9')) return `0${d}`;
-  return d.startsWith('0') ? d : d;
+  return d || null;
+}
+
+function personWithMobile(organizationId: string, mobile: string): Prisma.PersonWhereInput {
+  const keys = phoneIdentityKeys(mobile);
+  return {
+    organizationId,
+    OR: [{ mobile: { in: keys } }, { phone: { in: keys } }],
+  };
 }
 
 function leadAccessWhere(actor: Actor): Prisma.LeadWhereInput {
@@ -129,7 +148,11 @@ export class LeadsService {
       source?: string;
       unassigned?: boolean;
       archived?: boolean;
+      converted?: boolean;
       hasMobile?: boolean;
+      followUp?: string;
+      createdFrom?: string;
+      createdTo?: string;
     },
   ): Prisma.LeadWhereInput {
     const search = buildSearchWhere<Prisma.LeadWhereInput>(opts.q, (t) => [
@@ -148,22 +171,77 @@ export class LeadsService {
     if (opts.hasMobile) {
       and.push({ mobile: { not: '' } });
     }
+    const follow = this.followUpWhere(opts.followUp);
+    if (follow) and.push(follow);
+    const createdRange = this.createdAtWhere(opts.createdFrom, opts.createdTo);
+    if (createdRange) and.push(createdRange);
     return {
-      organizationId: actor.organizationId,
-      ...leadAccessWhere(actor),
-      archivedAt: opts.archived ? { not: null } : null,
-      ...(opts.stageId ? { stageId: opts.stageId } : {}),
-      ...(opts.assigneeId ? { assigneeId: opts.assigneeId } : {}),
-      ...(opts.unassigned ? { assigneeId: null } : {}),
-      ...(opts.city ? { city: { contains: opts.city, mode: 'insensitive' } } : {}),
-      ...(opts.region
-        ? { region: { contains: opts.region, mode: 'insensitive' } }
-        : {}),
-      ...(opts.trade ? { trade: { contains: opts.trade, mode: 'insensitive' } } : {}),
-      ...(opts.source
-        ? { source: { contains: opts.source, mode: 'insensitive' } }
-        : {}),
-      ...(and.length ? { AND: and } : {}),
+      AND: [
+        {
+          organizationId: actor.organizationId,
+          ...leadAccessWhere(actor),
+          archivedAt: opts.archived ? { not: null } : null,
+          ...(opts.converted ? { convertedPersonId: { not: null } } : {}),
+          ...(opts.stageId ? { stageId: opts.stageId } : {}),
+          ...(opts.city ? { city: { contains: opts.city, mode: 'insensitive' } } : {}),
+          ...(opts.region
+            ? { region: { contains: opts.region, mode: 'insensitive' } }
+            : {}),
+          ...(opts.trade ? { trade: { contains: opts.trade, mode: 'insensitive' } } : {}),
+          ...(opts.source
+            ? { source: { contains: opts.source, mode: 'insensitive' } }
+            : {}),
+        },
+        ...(opts.unassigned ? [{ assigneeId: null }] : []),
+        ...(opts.assigneeId && !opts.unassigned ? [{ assigneeId: opts.assigneeId }] : []),
+        ...and,
+      ],
+    };
+  }
+
+  /** مرز روز به وقت تهران برای فیلترهای «امروز». */
+  private tehranDayBounds(day = tehranDayKey()) {
+    const start = tehranDayStart(day);
+    const end = tehranDayStart(addDays(day, 1));
+    return { start, end };
+  }
+
+  private followUpWhere(followUp?: string): Prisma.LeadWhereInput | null {
+    if (!followUp) return null;
+    const { start, end } = this.tehranDayBounds();
+    switch (followUp) {
+      case 'due_today':
+        return { nextFollowUpAt: { gte: start, lt: end } };
+      case 'overdue':
+        return { nextFollowUpAt: { not: null, lt: start } };
+      case 'called_today':
+        return { lastContactAt: { gte: start, lt: end } };
+      case 'missed_today':
+        return {
+          nextFollowUpAt: { not: null, lt: end },
+          OR: [{ lastContactAt: null }, { lastContactAt: { lt: start } }],
+        };
+      case 'no_follow_up':
+        return { nextFollowUpAt: null };
+      default:
+        return null;
+    }
+  }
+
+  private createdAtWhere(
+    createdFrom?: string,
+    createdTo?: string,
+  ): Prisma.LeadWhereInput | null {
+    const from = isDayKey(createdFrom) ? tehranDayStart(createdFrom) : null;
+    const to = isDayKey(createdTo)
+      ? tehranDayStart(addDays(createdTo, 1))
+      : null;
+    if (!from && !to) return null;
+    return {
+      createdAt: {
+        ...(from ? { gte: from } : {}),
+        ...(to ? { lt: to } : {}),
+      },
     };
   }
 
@@ -181,8 +259,12 @@ export class LeadsService {
       source?: string;
       unassigned?: boolean;
       archived?: boolean;
+      converted?: boolean;
       sort?: string;
       hasMobile?: boolean;
+      followUp?: string;
+      createdFrom?: string;
+      createdTo?: string;
     },
   ): Promise<PaginatedResponse<LeadDto>> {
     await this.stages.ensureDefaults(actor.organizationId);
@@ -230,7 +312,11 @@ export class LeadsService {
       source?: string;
       unassigned?: boolean;
       archived?: boolean;
+      converted?: boolean;
       hasMobile?: boolean;
+      followUp?: string;
+      createdFrom?: string;
+      createdTo?: string;
     },
     max = FILTERED_IDS_MAX,
   ): Promise<FilteredIdsResponse> {
@@ -322,10 +408,7 @@ export class LeadsService {
       };
     }
     const person = await this.prisma.person.findFirst({
-      where: {
-        organizationId: actor.organizationId,
-        OR: [{ mobile }, { phone: mobile }],
-      },
+      where: personWithMobile(actor.organizationId, mobile),
       select: { id: true, firstName: true, lastName: true },
     });
     if (person) {
@@ -613,24 +696,43 @@ export class LeadsService {
     });
     if (!stage) throw new NotFoundException('مرحله پیدا نشد');
 
+    let placedIds: string[] | null = null;
+    let nextPosition = position ?? 0;
+    if (position != null) {
+      const rows = await this.prisma.lead.findMany({
+        where: { organizationId: actor.organizationId, stageId, archivedAt: null },
+        select: { id: true },
+        orderBy: [{ position: 'asc' }, { updatedAt: 'desc' }],
+      });
+      const currentIds = rows.map((row) => row.id);
+      placedIds = placeId(currentIds, id, position);
+      nextPosition = Math.max(0, placedIds.indexOf(id));
+      if (sameIds(currentIds, placedIds)) placedIds = null;
+    }
+
     const row = await this.prisma.lead.update({
       where: { id },
       data: {
         stageId,
-        position: position ?? 0,
-        ...(stage.isConverted
-          ? {}
-          : {}),
+        position: nextPosition,
       },
       include: leadInclude,
     });
-    await this.addEvent(
-      actor,
-      id,
-      'stage_changed',
-      `به مرحله «${stage.name}» منتقل شد`,
-    );
+    if (placedIds) {
+      await writePositions(
+        (ops) => this.prisma.$transaction(ops),
+        placedIds,
+        (leadId, leadPosition) =>
+          this.prisma.lead.update({ where: { id: leadId }, data: { position: leadPosition } }),
+      );
+    }
     if (before.stageId !== stageId) {
+      await this.addEvent(
+        actor,
+        id,
+        'stage_changed',
+        `به مرحله «${stage.name}» منتقل شد`,
+      );
       this.gameEvent(actor, 'LEAD_STAGE_CHANGED', row, {
         eventKey: `${id}:${stageId}`,
         facts: { stageName: stage.name, source: row.source },
@@ -946,10 +1048,7 @@ export class LeadsService {
     }
 
     let person = await this.prisma.person.findFirst({
-      where: {
-        organizationId: actor.organizationId,
-        OR: [{ mobile: lead.mobile }, { phone: lead.mobile }],
-      },
+      where: personWithMobile(actor.organizationId, lead.mobile),
     });
     let createdPerson = false;
 
@@ -976,7 +1075,7 @@ export class LeadsService {
           lastName: named.lastName,
           gender: named.gender,
           showGenderInName: named.showGenderInName,
-          mobile: lead.mobile,
+          mobile: canonicalIranMobile(lead.mobile) ?? lead.mobile,
           phone: lead.phone,
           instagram: lead.instagram,
           birthDate: lead.birthDate,
@@ -1090,7 +1189,7 @@ export class LeadsService {
       newStage
         ? this.prisma.lead.count({ where: { ...base, stageId: newStage.id } })
         : Promise.resolve(0),
-      this.prisma.lead.count({ where: { ...base, assigneeId: null } }),
+      this.prisma.lead.count({ where: { AND: [base, { assigneeId: null }] } }),
       convertedIds.length
         ? this.prisma.lead.count({
             where: { ...base, stageId: { in: convertedIds } },
@@ -1150,6 +1249,95 @@ export class LeadsService {
     };
   }
 
+  async createFromExternal(input: {
+    organizationId: string;
+    siteName: string;
+    firstName?: string | null;
+    lastName?: string | null;
+    mobile: string;
+    storeName?: string | null;
+    source?: string | null;
+  }): Promise<{
+    ok: true;
+    created: boolean;
+    duplicate: boolean;
+    leadId: string | null;
+  }> {
+    const mobile = mobileKey(input.mobile);
+    if (!mobile || !/^09\d{9}$/.test(mobile)) {
+      throw new BadRequestException('شماره موبایل معتبر نیست');
+    }
+
+    const contactName =
+      `${input.firstName?.trim() ?? ''} ${input.lastName?.trim() ?? ''}`.trim() || null;
+    const storeName = input.storeName?.trim() ?? '';
+    const source = emptyToNull(input.source);
+    const title = storeName || contactName || mobile;
+    const siteName = input.siteName.trim() || 'سایت بیرونی';
+
+    const existing = await this.prisma.lead.findFirst({
+      where: { organizationId: input.organizationId, mobile, archivedAt: null },
+      select: { id: true, source: true, contactName: true },
+    });
+    if (existing) {
+      const patch: Prisma.LeadUpdateInput = {};
+      if (!existing.source && source) patch.source = source;
+      if (!existing.contactName && contactName) patch.contactName = contactName;
+      if (Object.keys(patch).length) {
+        await this.prisma.lead.update({ where: { id: existing.id }, data: patch });
+      }
+      await this.prisma.leadEvent.create({
+        data: {
+          organizationId: input.organizationId,
+          leadId: existing.id,
+          type: 'note',
+          title: 'درخواست دوباره از سایت',
+          body: [`سایت: ${siteName}`, source ? `منبع: ${source}` : null]
+            .filter(Boolean)
+            .join('\n'),
+        },
+      });
+      return { ok: true, created: false, duplicate: true, leadId: existing.id };
+    }
+
+    const person = await this.prisma.person.findFirst({
+      where: personWithMobile(input.organizationId, mobile),
+      select: { id: true },
+    });
+    if (person) {
+      return { ok: true, created: false, duplicate: true, leadId: null };
+    }
+
+    await this.stages.ensureDefaults(input.organizationId);
+    const stages = await this.stages.list(input.organizationId);
+    const stageId = stages[0]?.id;
+    if (!stageId) throw new BadRequestException('مرحله‌ای تعریف نشده');
+
+    const lead = await this.prisma.lead.create({
+      data: {
+        organizationId: input.organizationId,
+        title,
+        contactName,
+        mobile,
+        source,
+        notes: `ثبت از سایت: ${siteName}`,
+        stageId,
+      },
+    });
+    await this.prisma.leadEvent.create({
+      data: {
+        organizationId: input.organizationId,
+        leadId: lead.id,
+        type: 'created',
+        title: 'لید از سایت ثبت شد',
+        body: [`سایت: ${siteName}`, source ? `منبع: ${source}` : null]
+          .filter(Boolean)
+          .join('\n'),
+      },
+    });
+    return { ok: true, created: true, duplicate: false, leadId: lead.id };
+  }
+
   async createFromImportRow(
     organizationId: string,
     createdById: string | null,
@@ -1192,10 +1380,7 @@ export class LeadsService {
     }
 
     const existingPerson = await this.prisma.person.findFirst({
-      where: {
-        organizationId,
-        OR: [{ mobile }, { phone: mobile }],
-      },
+      where: personWithMobile(organizationId, mobile),
       select: { id: true },
     });
     if (existingPerson) {

apps/api/src/memberships/memberships.service.ts

@@ -1,4 +1,5 @@
 import {
+  BadRequestException,
   ForbiddenException,
   Injectable,
   NotFoundException,
@@ -70,6 +71,16 @@ export class MembershipsService {
     }));
   }
 
+  /** هر محیط یک مالک فعال دارد: همان کسی که محیط را ثبت کرده. */
+  async assertSoleOwner(organizationId: string, userId: string) {
+    const others = await this.countActiveOwners(organizationId, userId);
+    if (others > 0) {
+      throw new BadRequestException(
+        'هر محیط فقط یک مالک دارد و مالک همان کسی است که ثبت‌نام کرده. برای دسترسی کامل نقش مدیر را انتخاب کنید.',
+      );
+    }
+  }
+
   async createMembership(data: {
     userId: string;
     organizationId: string;
@@ -78,6 +89,9 @@ export class MembershipsService {
     commissionPercent?: number;
     isActive?: boolean;
   }) {
+    if (data.role === 'owner' && data.isActive !== false) {
+      await this.assertSoleOwner(data.organizationId, data.userId);
+    }
     return this.prisma.membership.create({
       data: {
         userId: data.userId,

apps/api/src/org-roles/dto.ts

@@ -2,6 +2,7 @@ import { Type } from 'class-transformer';
 import {
   ArrayUnique,
   IsArray,
+  IsBoolean,
   IsIn,
   IsObject,
   IsOptional,
@@ -45,6 +46,16 @@ export class CreateOrgRoleDto {
   @ValidateIf((_, v) => v !== null)
   @IsString()
   parentId?: string | null;
+
+  @IsOptional()
+  @IsArray()
+  @ArrayUnique()
+  @IsString({ each: true })
+  treasuryAccountIds?: string[];
+
+  @IsOptional()
+  @IsBoolean()
+  treasuryOwnAccounts?: boolean;
 }
 
 export class UpdateOrgRoleDto {
@@ -77,6 +88,16 @@ export class UpdateOrgRoleDto {
   @ValidateIf((_, v) => v !== null)
   @IsString()
   parentId?: string | null;
+
+  @IsOptional()
+  @IsArray()
+  @ArrayUnique()
+  @IsString({ each: true })
+  treasuryAccountIds?: string[];
+
+  @IsOptional()
+  @IsBoolean()
+  treasuryOwnAccounts?: boolean;
 }
 
 export class RolePermissionPatchItemDto {

apps/api/src/org-roles/org-roles.service.ts

@@ -32,6 +32,8 @@ type RoleRow = {
   color: string;
   permissions: string[];
   dataAccessPolicy?: unknown;
+  treasuryAccountIds?: string[];
+  treasuryOwnAccounts?: boolean;
   systemKey: string | null;
   parentId: string | null;
   createdAt: Date;
@@ -79,6 +81,8 @@ export class OrgRolesService {
       permissions?: RolePermissionKey[];
       dataAccessPolicy?: DataAccessPolicy;
       parentId?: string | null;
+      treasuryAccountIds?: string[];
+      treasuryOwnAccounts?: boolean;
     },
   ): Promise<OrgRoleDto> {
     this.assertManager(actorRole);
@@ -108,6 +112,8 @@ export class OrgRolesService {
           description: (dto.description ?? '').trim(),
           color: dto.color ?? parent?.color ?? 'teal',
           permissions,
+          treasuryAccountIds: dto.treasuryAccountIds ?? [],
+          treasuryOwnAccounts: dto.treasuryOwnAccounts ?? false,
           parentId,
           ...(dto.dataAccessPolicy
             ? { dataAccessPolicy: parseDataAccessPolicy(dto.dataAccessPolicy) }
@@ -135,6 +141,8 @@ export class OrgRolesService {
       permissions?: RolePermissionKey[];
       dataAccessPolicy?: DataAccessPolicy;
       parentId?: string | null;
+      treasuryAccountIds?: string[];
+      treasuryOwnAccounts?: boolean;
     },
   ): Promise<OrgRoleDto> {
     this.assertManager(actorRole);
@@ -159,6 +167,12 @@ export class OrgRolesService {
     if (dto.dataAccessPolicy !== undefined) {
       data.dataAccessPolicy = parseDataAccessPolicy(dto.dataAccessPolicy);
     }
+    if (dto.treasuryAccountIds !== undefined) {
+      data.treasuryAccountIds = [...new Set(dto.treasuryAccountIds.map((id) => id.trim()).filter(Boolean))];
+    }
+    if (dto.treasuryOwnAccounts !== undefined) {
+      data.treasuryOwnAccounts = dto.treasuryOwnAccounts;
+    }
 
     if (dto.parentId !== undefined) {
       const nextParentId =
@@ -426,6 +440,8 @@ export class OrgRolesService {
       color: row.color,
       permissions: sanitizePermissions(row.permissions),
       dataAccessPolicy: parseDataAccessPolicy(row.dataAccessPolicy),
+      treasuryAccountIds: row.treasuryAccountIds ?? [],
+      treasuryOwnAccounts: row.treasuryOwnAccounts ?? false,
       systemKey,
       parentId: row.parentId,
       parentName: row.parentId ? (nameById.get(row.parentId) ?? null) : null,

apps/api/src/pipelines/deals-excel.service.ts

@@ -14,7 +14,7 @@ import type { Actor } from '../common/record-scope';
 import { dealAccessWhere, resolveOwnerId } from '../common/record-scope';
 import { dealPriorWhere } from '../common/prior-archive';
 import { asCustomFields, toJsonCustomFields } from '../common/custom-fields';
-import { normalizePhone } from '../contacts/normalize';
+import { phoneIdentityKeys, storedPhoneNumber } from '../contacts/normalize';
 import {
   excelFieldsFromColumns,
   formatJalaliDate,
@@ -708,9 +708,9 @@ export class DealsExcelService {
   ): Promise<string | null> {
     const orgId = actor.organizationId;
     const code = cleanCode(row.personCode);
-    const mobile = normalizePhone(row.personMobile);
-    const mobileCore = mobile ? mobile.replace(/^\+98|^98|^0/, '') : '';
-    const validMobile = mobileCore.length >= 8 ? mobile : null;
+    const mobile = storedPhoneNumber(row.personMobile);
+    const mobileKeys = phoneIdentityKeys(mobile);
+    const validMobile = (mobile ?? '').replace(/\D/g, '').length >= 8 ? mobile : null;
     const first = (row.personFirstName ?? '').trim();
     const last = (row.personName ?? '').trim();
     const fullName = [first, last].filter(Boolean).join(' ');
@@ -731,7 +731,10 @@ export class DealsExcelService {
     }
     if (!found && validMobile) {
       found = await this.prisma.person.findFirst({
-        where: { organizationId: orgId, mobile: { contains: mobileCore } },
+        where: {
+          organizationId: orgId,
+          OR: [{ mobile: { in: mobileKeys } }, { phone: { in: mobileKeys } }],
+        },
         select: { id: true },
       });
     }

apps/api/src/pipelines/deals.service.ts

@@ -27,6 +27,7 @@ import {
   resolveOwnerId,
 } from '../common/record-scope';
 import { actorCanAssignToOthers, assertAssigneeSet } from '../common/assign-access';
+import { placeId, sameIds, writePositions } from '../common/column-order';
 
 const dealInclude = {
   person: { select: { id: true, firstName: true, lastName: true } },
@@ -379,7 +380,8 @@ export class DealsService {
     }
 
     const status = stage.isWon ? 'won' : stage.isLost ? 'lost' : 'open';
-    const position =
+    let placedIds: string[] | null = null;
+    let position =
       dto.position ??
       ((
         await this.prisma.deal.aggregate({
@@ -387,6 +389,17 @@ export class DealsService {
           _max: { position: true },
         })
       )._max.position ?? -1) + 1;
+    if (dto.position != null) {
+      const rows = await this.prisma.deal.findMany({
+        where: { organizationId, stageId: stage.id },
+        select: { id: true },
+        orderBy: [{ position: 'asc' }, { updatedAt: 'desc' }],
+      });
+      const currentIds = rows.map((row) => row.id);
+      placedIds = placeId(currentIds, deal.id, dto.position);
+      position = Math.max(0, placedIds.indexOf(deal.id));
+      if (sameIds(currentIds, placedIds)) placedIds = null;
+    }
 
     const row = await this.prisma.deal.update({
       where: { id },
@@ -402,6 +415,15 @@ export class DealsService {
       include: dealInclude,
     });
 
+    if (placedIds) {
+      await writePositions(
+        (ops) => this.prisma.$transaction(ops),
+        placedIds,
+        (dealId, nextPosition) =>
+          this.prisma.deal.update({ where: { id: dealId }, data: { position: nextPosition } }),
+      );
+    }
+
     if (deal.ownerId && deal.stageId !== stage.id) {
       await this.notifications.create({
         organizationId,

apps/api/src/pipelines/pipelines.controller.ts

@@ -31,8 +31,11 @@ export class PipelinesController {
   constructor(private readonly pipelinesService: PipelinesService) {}
 
   @Get()
-  list(@CurrentUser() user: { organizationId: string }) {
-    return this.pipelinesService.list(user.organizationId);
+  list(
+    @CurrentUser() user: Actor,
+    @Query('forLens') forLens?: string,
+  ) {
+    return this.pipelinesService.list(user, forLens === '1');
   }
 
   @Get('board')

apps/api/src/pipelines/pipelines.service.ts

@@ -4,6 +4,10 @@ import {
   NotFoundException,
 } from '@nestjs/common';
 import type {
+  ActivityStatus,
+  ActivityType,
+  DealActivityCue,
+  DealActivitySummaryDto,
   DealDto,
   MergePipelineResultDto,
   PipelineBoardDto,
@@ -102,24 +106,55 @@ export class PipelinesService {
     return this.toPipelineDto(created);
   }
 
-  async list(organizationId: string): Promise<PipelineDto[]> {
+  async list(actorOrOrgId: Actor | string, forLens = false): Promise<PipelineDto[]> {
+    const organizationId =
+      typeof actorOrOrgId === 'string' ? actorOrOrgId : actorOrOrgId.organizationId;
+    const actor = typeof actorOrOrgId === 'string' ? undefined : actorOrOrgId;
     await this.ensureDefaultPipeline(organizationId);
     const rows = await this.prisma.pipeline.findMany({
       where: { organizationId },
       include: { stages: { orderBy: { position: 'asc' } } },
       orderBy: [{ isDefault: 'desc' }, { name: 'asc' }],
     });
-    const counts = await this.prisma.deal.groupBy({
-      by: ['pipelineId'],
-      where: { organizationId },
-      _count: { _all: true },
-    });
+    const lens = actor?.priorLens;
+    const lensActive = forLens && (lens === 'current' || lens === 'archive');
+    const access = actor ? dealAccessWhere(actor) : {};
+    const prior = lensActive
+      ? dealPriorWhere(actor?.priorLens, actor?.priorCutoff)
+      : {};
+    const [counts, lensCounts] = await Promise.all([
+      this.prisma.deal.groupBy({
+        by: ['pipelineId'],
+        where: lensActive ? { organizationId, AND: [access] } : { organizationId },
+        _count: { _all: true },
+      }),
+      lensActive
+        ? this.prisma.deal.groupBy({
+            by: ['pipelineId'],
+            where: { organizationId, AND: [access, prior] },
+            _count: { _all: true },
+          })
+        : Promise.resolve([]),
+    ]);
     const dealCountByPipeline = new Map(
       counts.map((row) => [row.pipelineId, row._count._all]),
     );
-    return rows.map((row) => ({
+    const lensCountByPipeline = new Map(
+      lensCounts.map((row) => [row.pipelineId, row._count._all]),
+    );
+    const visible = lensActive
+      ? rows.filter((row) => {
+          const inLens = lensCountByPipeline.get(row.id) ?? 0;
+          const total = dealCountByPipeline.get(row.id) ?? 0;
+          if (lens === 'archive') return inLens > 0;
+          return inLens > 0 || total === 0;
+        })
+      : rows;
+    return visible.map((row) => ({
       ...this.toPipelineDto(row),
-      dealCount: dealCountByPipeline.get(row.id) ?? 0,
+      dealCount: lensActive
+        ? (lensCountByPipeline.get(row.id) ?? 0)
+        : (dealCountByPipeline.get(row.id) ?? 0),
     }));
   }
 
@@ -343,12 +378,23 @@ export class PipelinesService {
     });
 
     const rateMap = await loadOrgRates(this.prisma, organizationId);
+    const activityHints = await this.loadDealActivityHints(
+      organizationId,
+      deals.map((deal) => deal.id),
+    );
 
     const byStage = new Map<string, DealDto[]>();
     for (const stage of resolved.stages) byStage.set(stage.id, []);
     for (const deal of deals) {
       const list = byStage.get(deal.stageId);
-      if (list) list.push(this.toDealDto(deal));
+      if (list) {
+        const hint = activityHints.get(deal.id);
+        list.push({
+          ...this.toDealDto(deal),
+          activityCue: hint?.cue ?? 'none',
+          activitySummaries: hint?.summaries ?? [],
+        });
+      }
     }
 
     return {
@@ -566,6 +612,105 @@ export class PipelinesService {
     };
   }
 
+  private async loadDealActivityHints(
+    organizationId: string,
+    dealIds: string[],
+  ): Promise<
+    Map<string, { cue: DealActivityCue; summaries: DealActivitySummaryDto[] }>
+  > {
+    const hints = new Map<
+      string,
+      { cue: DealActivityCue; summaries: DealActivitySummaryDto[] }
+    >();
+    if (!dealIds.length) return hints;
+
+    const rows = await this.prisma.activity.findMany({
+      where: {
+        organizationId,
+        dealId: { in: dealIds },
+        status: { in: ['open', 'done'] },
+      },
+      select: {
+        id: true,
+        dealId: true,
+        title: true,
+        type: true,
+        status: true,
+        dueAt: true,
+        completedAt: true,
+      },
+    });
+
+    type Row = {
+      id: string;
+      title: string;
+      type: string;
+      status: 'open' | 'done';
+      dueAt: Date | null;
+      completedAt: Date | null;
+    };
+    const byDeal = new Map<string, Row[]>();
+    for (const row of rows) {
+      if (!row.dealId) continue;
+      const list = byDeal.get(row.dealId) ?? [];
+      list.push({
+        id: row.id,
+        title: row.title,
+        type: row.type,
+        status: row.status === 'done' ? 'done' : 'open',
+        dueAt: row.dueAt,
+        completedAt: row.completedAt,
+      });
+      byDeal.set(row.dealId, list);
+    }
+
+    const now = Date.now();
+    const cueOf = (item: Row): Exclude<DealActivityCue, 'none'> => {
+      if (item.status === 'done') return 'done';
+      if (item.dueAt && item.dueAt.getTime() < now) return 'overdue';
+      return 'upcoming';
+    };
+    const rank = (cue: Exclude<DealActivityCue, 'none'>) =>
+      cue === 'overdue' ? 0 : cue === 'upcoming' ? 1 : 2;
+
+    for (const dealId of dealIds) {
+      const list = byDeal.get(dealId) ?? [];
+      const summaries = list
+        .map((item) => {
+          const cue = cueOf(item);
+          return {
+            id: item.id,
+            title: item.title,
+            type: item.type as ActivityType,
+            status: item.status as ActivityStatus,
+            dueAt: item.dueAt?.toISOString() ?? null,
+            cue,
+            _due: item.dueAt?.getTime() ?? Number.POSITIVE_INFINITY,
+            _done: item.completedAt?.getTime() ?? 0,
+          };
+        })
+        .sort((a, b) => {
+          const byRank = rank(a.cue) - rank(b.cue);
+          if (byRank) return byRank;
+          if (a.cue === 'done' && b.cue === 'done') return b._done - a._done;
+          return a._due - b._due;
+        })
+        .map(({ _due: _d, _done: _c, ...summary }) => summary);
+
+      const open = list.filter((item) => item.status === 'open');
+      let cue: DealActivityCue = 'none';
+      if (open.some((item) => item.dueAt && item.dueAt.getTime() < now)) {
+        cue = 'overdue';
+      } else if (open.length) {
+        cue = 'upcoming';
+      } else if (list.some((item) => item.status === 'done')) {
+        cue = 'done';
+      }
+      hints.set(dealId, { cue, summaries });
+    }
+    return hints;
+  }
+
   toDealDto(row: DealRow): DealDto {
     return {
       id: row.id,

apps/api/src/platform/dto.ts

@@ -13,7 +13,7 @@ import {
   MinLength,
   ValidateIf,
 } from 'class-validator';
-import { USER_ROLES, type UserRole } from '@mento/shared';
+import { PRODUCT_PLAN_CODES, USER_ROLES, type ProductPlanCode, type UserRole } from '@mento/shared';
 
 export class PlatformLoginDto {
   @IsString()
@@ -189,6 +189,11 @@ export class SetStorageQuotaDto {
   quotaGb!: number | null;
 }
 
+export class ApplyProductPlanDto {
+  @IsIn(PRODUCT_PLAN_CODES)
+  planCode!: ProductPlanCode;
+}
+
 export class UpdateOrgModulesDto {
   @IsArray()
   @IsString({ each: true })

apps/api/src/platform/platform.controller.ts

@@ -13,6 +13,7 @@ import {
 import { CurrentUser } from '../auth/current-user.decorator';
 import {
   ApplyBillingPlanDto,
+  ApplyProductPlanDto,
   SetStorageQuotaDto,
   SetUserCapDto,
   CreatePlatformAdminDto,
@@ -168,6 +169,11 @@ export class PlatformController {
     return this.platform.setUserCap(id, dto.maxUsers);
   }
 
+  @Post('organizations/:id/product-plan')
+  applyProductPlan(@Param('id') id: string, @Body() dto: ApplyProductPlanDto) {
+    return this.platform.applyProductPlan(id, dto.planCode);
+  }
+
   @Patch('organizations/:id/modules')
   updateOrganizationModules(
     @Param('id') id: string,

apps/api/src/platform/platform.service.ts

@@ -9,6 +9,7 @@ import type {
   PlatformOrganizationDto,
   PlatformStatsDto,
   PlatformUserDto,
+  ProductPlanCode,
   UserRole,
 } from '@mento/shared';
 import { isBusinessField } from '@mento/shared';
@@ -472,6 +473,16 @@ export class PlatformService {
     return this.getUser(userId);
   }
 
+  async applyProductPlan(id: string, planCode: ProductPlanCode) {
+    const existing = await this.prisma.organization.findUnique({
+      where: { id },
+      select: { id: true },
+    });
+    if (!existing) throw new NotFoundException('محیط پیدا نشد');
+    await this.billing.applyProductPlan(id, planCode);
+    return this.getOrganization(id);
+  }
+
   async updateOrganizationModules(id: string, dto: UpdateOrgModulesDto) {
     const existing = await this.prisma.organization.findUnique({
       where: { id },
@@ -532,6 +543,9 @@ export class PlatformService {
     });
     if (!row) throw new NotFoundException('عضویت پیدا نشد');
     if (isActive && !row.isActive) {
+      if (row.role === 'owner') {
+        await this.memberships.assertSoleOwner(row.organizationId, row.userId);
+      }
       await this.billing.assertSeatAvailable(row.organizationId, row.userId);
     }
     if (!isActive && row.role === 'owner') {
@@ -562,6 +576,9 @@ export class PlatformService {
     });
     if (!row) throw new NotFoundException('عضویت پیدا نشد');
 
+    if (role === 'owner' && row.role !== 'owner') {
+      await this.memberships.assertSoleOwner(row.organizationId, row.userId);
+    }
     if (row.role === 'owner' && role !== 'owner') {
       const owners = await this.memberships.countActiveOwners(
         row.organizationId,
@@ -569,7 +586,7 @@ export class PlatformService {
       );
       if (owners < 1) {
         throw new BadRequestException(
-          'حداقل یک مالک برای سازمان لازم است؛ ابتدا مالک دیگری تعیین کنید',
+          'مالک محیط همان کسی است که ثبت‌نام کرده و نمی‌توان نقش او را عوض کرد',
         );
       }
     }

apps/api/src/portal/portal.service.ts

@@ -19,6 +19,7 @@ import type {
 } from '@mento/shared';
 import { TICKET_SLA_HOURS } from '@mento/shared';
 import { PrismaService } from '../prisma/prisma.service';
+import { canonicalIranMobile, phoneIdentityKeys } from '../contacts/normalize';
 import { SmsGatewayService } from '../sms-billing/sms-gateway.service';
 import type { PortalActor } from './portal-auth';
 
@@ -62,7 +63,7 @@ export class PortalService {
     mobileRaw: string,
   ): Promise<PortalRequestOtpResponse> {
     const org = await this.findOrg(slug);
-    const mobile = normalizeMobile(mobileRaw);
+    const mobile = canonicalIranMobile(mobileRaw) ?? normalizeMobile(mobileRaw);
     if (!mobile) {
       throw new BadRequestException('شماره موبایل معتبر نیست');
     }
@@ -123,7 +124,8 @@ export class PortalService {
     codeRaw: string,
   ): Promise<PortalLoginResponse> {
     const org = await this.findOrg(slug);
-    const mobile = normalizeMobile(mobileRaw);
+    const mobile = canonicalIranMobile(mobileRaw) ?? normalizeMobile(mobileRaw);
+    const mobileKeys = phoneIdentityKeys(mobile);
     const code = codeRaw.trim();
     if (!mobile || !code) {
       throw new BadRequestException('موبایل یا کد ناقص است');
@@ -148,10 +150,15 @@ export class PortalService {
       data: { consumedAt: new Date() },
     });
 
-    let person = await this.prisma.person.findFirst({
-      where: { organizationId: org.id, mobile },
-      orderBy: { createdAt: 'asc' },
-    });
+    let person = mobileKeys.length
+      ? await this.prisma.person.findFirst({
+          where: {
+            organizationId: org.id,
+            OR: [{ mobile: { in: mobileKeys } }, { phone: { in: mobileKeys } }],
+          },
+          orderBy: { createdAt: 'asc' },
+        })
+      : null;
     if (!person) {
       person = await this.prisma.person.create({
         data: {

apps/api/src/project-boards/project-cards-excel.service.ts

@@ -3,7 +3,7 @@ import type { ImportContactsResult } from '@mento/shared';
 import { PrismaService } from '../prisma/prisma.service';
 import type { Actor } from '../common/record-scope';
 import { projectCardAccessWhere } from '../common/record-scope';
-import { normalizePhone } from '../contacts/normalize';
+import { phoneIdentityKeys, storedPhoneNumber } from '../contacts/normalize';
 import {
   excelFieldsFromColumns,
   formatJalaliDate,
@@ -256,11 +256,13 @@ export class ProjectCardsExcelService {
   }
 
   private async findPersonId(organizationId: string, row: Record<string, string>) {
-    const mobile = normalizePhone(row.personMobile);
-    if (mobile) {
-      const needle = mobile.replace(/^\+98|^98|^0/, '');
+    const mobileKeys = phoneIdentityKeys(storedPhoneNumber(row.personMobile));
+    if (mobileKeys.length) {
       const byMobile = await this.prisma.person.findFirst({
-        where: { organizationId, mobile: { contains: needle } },
+        where: {
+          organizationId,
+          OR: [{ mobile: { in: mobileKeys } }, { phone: { in: mobileKeys } }],
+        },
         select: { id: true },
       });
       if (byMobile) return byMobile.id;

apps/api/src/public-api/api-key-auth.guard.ts

@@ -22,6 +22,7 @@ export class ApiKeyAuthGuard implements CanActivate {
         organizationId: string;
         role: string;
         apiKeyId?: string;
+        apiKeyName?: string;
       };
     }>();
 
@@ -44,6 +45,7 @@ export class ApiKeyAuthGuard implements CanActivate {
       organizationId: auth.organizationId,
       role: auth.role,
       apiKeyId: auth.apiKeyId,
+      apiKeyName: auth.name,
     };
     return true;
   }

apps/api/src/public-api/api-keys.service.ts

@@ -63,7 +63,7 @@ export class ApiKeysService {
 
   async authenticate(
     rawKey: string,
-  ): Promise<{ organizationId: string; apiKeyId: string; role: 'owner' }> {
+  ): Promise<{ organizationId: string; apiKeyId: string; name: string; role: 'owner' }> {
     const key = rawKey.trim();
     if (!key.startsWith('mk_') || key.length < 20) {
       throw new UnauthorizedException('کلید API نامعتبر است');
@@ -71,7 +71,7 @@ export class ApiKeysService {
     const keyHash = this.hashKey(key);
     const row = await this.prisma.organizationApiKey.findFirst({
       where: { keyHash, revokedAt: null },
-      select: { id: true, organizationId: true },
+      select: { id: true, organizationId: true, name: true },
     });
     if (!row) throw new UnauthorizedException('کلید API نامعتبر است');
 
@@ -83,6 +83,7 @@ export class ApiKeysService {
     return {
       organizationId: row.organizationId,
       apiKeyId: row.id,
+      name: row.name,
       role: 'owner',
     };
   }

apps/api/src/public-api/public-api-v1.controller.ts

@@ -1,18 +1,55 @@
 import {
+  Body,
   Controller,
   Get,
+  HttpCode,
+  HttpException,
+  HttpStatus,
   Param,
+  Post,
   Query,
   UseGuards,
 } from '@nestjs/common';
-import { IsInt, IsOptional, IsString, Max, Min } from 'class-validator';
+import { IsInt, IsOptional, IsString, Max, MaxLength, Min, MinLength } from 'class-validator';
 import { Type } from 'class-transformer';
 import { CurrentUser } from '../auth/current-user.decorator';
 import type { Prisma } from '@prisma/client';
 import { PrismaService } from '../prisma/prisma.service';
 import { buildSearchWhere, ci } from '../common/search';
+import { LeadsService } from '../leads/leads.service';
 import { ApiKeyAuthGuard } from './api-key-auth.guard';
 
+class CreateExternalLeadDto {
+  @IsOptional()
+  @IsString()
+  @MaxLength(80)
+  firstName?: string;
+
+  @IsOptional()
+  @IsString()
+  @MaxLength(80)
+  lastName?: string;
+
+  @IsString()
+  @MinLength(8)
+  @MaxLength(20)
+  mobile!: string;
+
+  @IsOptional()
+  @IsString()
+  @MaxLength(200)
+  storeName?: string;
+
+  @IsOptional()
+  @IsString()
+  @MaxLength(200)
+  source?: string;
+}
+
+const LEAD_RATE_WINDOW_MS = 60_000;
+const LEAD_RATE_MAX = 60;
+const leadHits = new Map<string, number[]>();
+
 class ListQueryDto {
   @IsOptional()
   @IsString()
@@ -35,7 +72,36 @@ class ListQueryDto {
 @Controller('public/v1')
 @UseGuards(ApiKeyAuthGuard)
 export class PublicApiV1Controller {
-  constructor(private readonly prisma: PrismaService) {}
+  constructor(
+    private readonly prisma: PrismaService,
+    private readonly leads: LeadsService,
+  ) {}
+
+  @Post('leads')
+  @HttpCode(200)
+  createLead(
+    @CurrentUser()
+    user: { organizationId: string; apiKeyId?: string; apiKeyName?: string },
+    @Body() body: CreateExternalLeadDto,
+  ) {
+    const bucket = user.apiKeyId || user.organizationId;
+    const now = Date.now();
+    const prev = (leadHits.get(bucket) ?? []).filter((t) => now - t < LEAD_RATE_WINDOW_MS);
+    if (prev.length >= LEAD_RATE_MAX) {
+      throw new HttpException('تعداد ارسال بیش از حد مجاز است. کمی بعد دوباره تلاش کنید.', HttpStatus.TOO_MANY_REQUESTS);
+    }
+    prev.push(now);
+    leadHits.set(bucket, prev);
+    return this.leads.createFromExternal({
+      organizationId: user.organizationId,
+      siteName: user.apiKeyName?.trim() || 'سایت بیرونی',
+      firstName: body.firstName,
+      lastName: body.lastName,
+      mobile: body.mobile,
+      storeName: body.storeName,
+      source: body.source,
+    });
+  }
 
   @Get('people')
   async listPeople(

apps/api/src/public-api/public-api.module.ts

@@ -1,6 +1,7 @@
 import { Module } from '@nestjs/common';
 import { AuthModule } from '../auth/auth.module';
 import { BillingModule } from '../billing/billing.module';
+import { LeadsModule } from '../leads/leads.module';
 import { ApiKeyAuthGuard } from './api-key-auth.guard';
 import { ApiKeysController } from './api-keys.controller';
 import { ApiKeysService } from './api-keys.service';
@@ -9,7 +10,7 @@ import { WebhooksController } from './webhooks.controller';
 import { WebhooksService } from './webhooks.service';
 
 @Module({
-  imports: [AuthModule, BillingModule],
+  imports: [AuthModule, BillingModule, LeadsModule],
   controllers: [ApiKeysController, WebhooksController, PublicApiV1Controller],
   providers: [ApiKeysService, ApiKeyAuthGuard, WebhooksService],
   exports: [ApiKeysService, WebhooksService],

apps/api/src/reports/reports.service.ts

@@ -18,6 +18,7 @@ import {
 } from '@mento/shared';
 import { Prisma } from '@prisma/client';
 import { PrismaService } from '../prisma/prisma.service';
+import { customersPersonWhere } from '../common/data-access';
 import {
   type Actor,
   assigneeWhere,
@@ -54,7 +55,7 @@ export class ReportsService {
     const invoiceScope = ownerWhere(actor, 'finance');
     const activityScope = assigneeWhere(actor);
     const ticketScope = ticketAccessWhere(actor);
-    const personScope = elevated(actor.role) ? {} : { ownerId: actor.userId };
+    const personScope = customersPersonWhere(actor);
 
     const durationMs = end.getTime() - start.getTime();
     const prevEnd = new Date(start.getTime() - 1);
@@ -1533,9 +1534,8 @@ export class ReportsService {
   async home(actor: Actor): Promise<HomeDashboardDto> {
     const orgId = actor.organizationId;
     const dealScope = ownerWhere(actor, 'deals');
-    const invoiceScope = ownerWhere(actor, 'finance');
     const activityScope = assigneeWhere(actor);
-    const personScope = elevated(actor.role) ? {} : { ownerId: actor.userId };
+    const personScope = customersPersonWhere(actor);
     const rates = await loadOrgRates(this.prisma, orgId);
     const now = new Date();
     const { jy, jm } = dateToJalali(now);
@@ -1544,7 +1544,6 @@ export class ReportsService {
     const prev = addJalaliMonths(jy, jm, -1);
     const prevMonthStart = startOfJalaliMonth(prev.jy, prev.jm);
     const prevMonthEnd = endOfJalaliMonth(prev.jy, prev.jm);
-    const trendWindowStart = addMonthsStart(now, -12);
 
     const todayStart = startOfDay(now);
     const todayEnd = endOfDay(now);
@@ -1557,25 +1556,17 @@ export class ReportsService {
     const dealsPrior = dealPriorWhere(actor.priorLens, actor.priorCutoff);
     const activitiesPrior = activityPriorWhere(actor.priorLens, actor.priorCutoff);
 
-    const invoiceStatuses: Array<'issued' | 'partially_paid' | 'paid'> = [
-      'issued',
-      'partially_paid',
-      'paid',
-    ];
-
     const [
       wonDeals,
-      openDealRows,
-      lostDeals,
+      openDeals,
       staleDeals,
-      peopleRecent,
+      peopleCur,
+      peoplePrev,
       openActivitiesToday,
       openActivitiesYesterday,
       openDealsWeekAgo,
       goals,
       overdueCount,
-      invoices,
-      activityTypeGroups,
     ] = await Promise.all([
       this.prisma.deal.findMany({
         where: {
@@ -1583,7 +1574,7 @@ export class ReportsService {
             {
               organizationId: orgId,
               status: 'won',
-              updatedAt: { gte: trendWindowStart },
+              updatedAt: { gte: addMonthsStart(now, -5) },
             },
             dealScope,
             dealsPrior,
@@ -1600,7 +1591,7 @@ export class ReportsService {
           person: { select: { id: true, firstName: true, lastName: true } },
         },
       }),
-      this.prisma.deal.findMany({
+      this.prisma.deal.count({
         where: {
           AND: [
             { organizationId: orgId, status: 'open' },
@@ -1608,30 +1599,6 @@ export class ReportsService {
             dealsPrior,
           ],
         },
-        select: {
-          amount: true,
-          currency: true,
-          stageId: true,
-          stage: { select: { id: true, name: true, position: true } },
-        },
-      }),
-      this.prisma.deal.findMany({
-        where: {
-          AND: [
-            {
-              organizationId: orgId,
-              status: 'lost',
-              updatedAt: { gte: trendWindowStart },
-            },
-            dealScope,
-            dealsPrior,
-          ],
-        },
-        select: {
-          amount: true,
-          currency: true,
-          lostReason: true,
-        },
       }),
       this.prisma.deal.findMany({
         where: {
@@ -1658,13 +1625,19 @@ export class ReportsService {
         orderBy: { updatedAt: 'asc' },
         take: 5,
       }),
-      this.prisma.person.findMany({
+      this.prisma.person.count({
         where: {
           organizationId: orgId,
           ...personScope,
-          createdAt: { gte: trendWindowStart, lte: curMonthEnd },
+          createdAt: { gte: curMonthStart, lte: curMonthEnd },
+        },
+      }),
+      this.prisma.person.count({
+        where: {
+          organizationId: orgId,
+          ...personScope,
+          createdAt: { gte: prevMonthStart, lte: prevMonthEnd },
         },
-        select: { createdAt: true, importSource: true },
       }),
       this.prisma.activity.count({
         where: {
@@ -1684,7 +1657,6 @@ export class ReportsService {
           AND: [
             {
               organizationId: orgId,
-              status: 'open',
               dueAt: { gte: yesterdayStart, lte: yesterdayEnd },
             },
             activityScope,
@@ -1726,67 +1698,8 @@ export class ReportsService {
           ],
         },
       }),
-      this.prisma.invoice.findMany({
-        where: {
-          organizationId: orgId,
-          ...invoiceScope,
-          status: { in: invoiceStatuses },
-          OR: [
-            { issuedAt: { gte: trendWindowStart, lte: curMonthEnd } },
-            { createdAt: { gte: trendWindowStart, lte: curMonthEnd } },
-          ],
-        },
-        select: {
-          issuedAt: true,
-          createdAt: true,
-          lineItems: {
-            select: {
-              quantity: true,
-              unitPrice: true,
-              currency: true,
-            },
-          },
-        },
-      }),
-      this.prisma.activity.groupBy({
-        by: ['type'],
-        where: {
-          AND: [
-            {
-              organizationId: orgId,
-              status: 'open',
-            },
-            activityScope,
-            activitiesPrior,
-          ],
-        },
-        _count: { _all: true },
-      }),
     ]);
 
-    const openDeals = openDealRows.length;
-
-    const invoiceInRange = (
-      inv: { issuedAt: Date | null; createdAt: Date },
-      from: Date,
-      to: Date,
-    ) => {
-      const anchor = inv.issuedAt ?? inv.createdAt;
-      return anchor >= from && anchor <= to;
-    };
-
-    const sumInvoiceInRange = (from: Date, to: Date) => {
-      let amount = 0;
-      for (const inv of invoices) {
-        if (!invoiceInRange(inv, from, to)) continue;
-        for (const line of inv.lineItems) {
-          const lineTotal = Number(line.quantity) * Number(line.unitPrice);
-          amount += toBaseAmount(lineTotal, line.currency, rates);
-        }
-      }
-      return amount;
-    };
-
     const sumWonInRange = (start: Date, end: Date) =>
       wonDeals
         .filter((d) => d.updatedAt >= start && d.updatedAt <= end)
@@ -1795,21 +1708,8 @@ export class ReportsService {
           0,
         );
 
-    const salesInRange = (start: Date, end: Date) => {
-      const inv = sumInvoiceInRange(start, end);
-      const won = sumWonInRange(start, end);
-      return Math.round(inv > 0 ? inv : won);
-    };
-
-    const peopleCur = peopleRecent.filter(
-      (p) => p.createdAt >= curMonthStart && p.createdAt <= curMonthEnd,
-    ).length;
-    const peoplePrev = peopleRecent.filter(
-      (p) => p.createdAt >= prevMonthStart && p.createdAt <= prevMonthEnd,
-    ).length;
-
-    const salesCur = salesInRange(curMonthStart, curMonthEnd);
-    const salesPrev = salesInRange(prevMonthStart, prevMonthEnd);
+    const salesCur = sumWonInRange(curMonthStart, curMonthEnd);
+    const salesPrev = sumWonInRange(prevMonthStart, prevMonthEnd);
     const targetAmount = goals.reduce(
       (acc, g) => acc + Number(g.targetAmount),
       0,
@@ -1817,7 +1717,7 @@ export class ReportsService {
 
     const trendMonths: Array<{ key: string; label: string; start: Date; end: Date }> =
       [];
-    for (let i = 11; i >= 0; i -= 1) {
+    for (let i = 4; i >= 0; i -= 1) {
       const m = addJalaliMonths(jy, jm, -i);
       trendMonths.push({
         key: `${m.jy}-${String(m.jm).padStart(2, '0')}`,
@@ -1830,28 +1730,14 @@ export class ReportsService {
     const salesTrend = trendMonths.map((m) => ({
       monthKey: m.key,
       monthLabel: m.label,
-      amount: salesInRange(m.start, m.end),
-    }));
-
-    const customerGrowth = trendMonths.map((m) => ({
-      monthKey: m.key,
-      monthLabel: m.label,
-      value: peopleRecent.filter(
-        (p) => p.createdAt >= m.start && p.createdAt <= m.end,
-      ).length,
+      amount: Math.round(sumWonInRange(m.start, m.end)),
     }));
 
     const sourceMap = new Map<string, number>();
-    for (const p of peopleRecent) {
-      const label = normalizeImportSource(p.importSource);
+    for (const d of wonDeals) {
+      const label = normalizeSource(d.source);
       sourceMap.set(label, (sourceMap.get(label) ?? 0) + 1);
     }
-    if (sourceMap.size === 0) {
-      for (const d of wonDeals) {
-        const label = normalizeSource(d.source);
-        sourceMap.set(label, (sourceMap.get(label) ?? 0) + 1);
-      }
-    }
     const sourceTotal = [...sourceMap.values()].reduce((a, b) => a + b, 0) || 1;
     const sources = [...sourceMap.entries()]
       .map(([label, count]) => ({
@@ -1895,101 +1781,6 @@ export class ReportsService {
       .slice(0, 5)
       .map((row, index) => ({ ...row, rank: index + 1 }));
 
-    const wonAmountAll = Math.round(
-      wonDeals.reduce(
-        (acc, d) => acc + decimalToBase(d.amount, d.currency, rates),
-        0,
-      ),
-    );
-    const lostAmountAll = Math.round(
-      lostDeals.reduce(
-        (acc, d) => acc + decimalToBase(d.amount, d.currency, rates),
-        0,
-      ),
-    );
-    const openAmountAll = Math.round(
-      openDealRows.reduce(
-        (acc, d) => acc + decimalToBase(d.amount, d.currency, rates),
-        0,
-      ),
-    );
-    const closedCount = wonDeals.length + lostDeals.length;
-    const winRate = closedCount
-      ? Math.round((wonDeals.length / closedCount) * 1000) / 10
-      : 0;
-    const salesSummary: HomeDashboardDto['salesSummary'] = {
-      openCount: openDeals,
-      wonCount: wonDeals.length,
-      lostCount: lostDeals.length,
-      openAmount: openAmountAll,
-      wonAmount: wonAmountAll,
-      lostAmount: lostAmountAll,
-      winRate,
-    };
-
-    const funnelMap = new Map<
-      string,
-      { stageId: string; stageName: string; position: number; count: number; amount: number }
-    >();
-    for (const d of openDealRows) {
-      const stageId = d.stage?.id ?? d.stageId ?? 'unknown';
-      const stageName = d.stage?.name ?? 'بدون مرحله';
-      const position = d.stage?.position ?? 999;
-      const cur = funnelMap.get(stageId) ?? {
-        stageId,
-        stageName,
-        position,
-        count: 0,
-        amount: 0,
-      };
-      cur.count += 1;
-      cur.amount += decimalToBase(d.amount, d.currency, rates);
-      funnelMap.set(stageId, cur);
-    }
-    const funnel = [...funnelMap.values()]
-      .sort((a, b) => a.position - b.position)
-      .slice(0, 8)
-      .map((row) => ({
-        stageId: row.stageId,
-        stageName: row.stageName,
-        count: row.count,
-        amount: Math.round(row.amount),
-      }));
-
-    const lostReasonMap = new Map<string, { count: number; amount: number }>();
-    for (const d of lostDeals) {
-      const label = normalizeLostReason(d.lostReason);
-      const prevRow = lostReasonMap.get(label) ?? { count: 0, amount: 0 };
-      prevRow.count += 1;
-      prevRow.amount += decimalToBase(d.amount, d.currency, rates);
-      lostReasonMap.set(label, prevRow);
-    }
-    const lostReasonTotal =
-      [...lostReasonMap.values()].reduce((a, b) => a + b.count, 0) || 1;
-    const lostReasons = [...lostReasonMap.entries()]
-      .map(([label, row]) => ({
-        label,
-        count: row.count,
-        amount: Math.round(row.amount),
-        percent: Math.round((row.count / lostReasonTotal) * 1000) / 10,
-      }))
-      .sort((a, b) => b.count - a.count)
-      .slice(0, 6);
-
-    const activityTypeLabel: Record<string, string> = {
-      call: 'تماس',
-      meeting: 'جلسه',
-      task: 'کار',
-      note: 'یادداشت',
-    };
-    const activityByType = activityTypeGroups
-      .map((row) => ({
-        type: row.type,
-        label: activityTypeLabel[row.type] ?? row.type,
-        count: row._count._all,
-      }))
-      .sort((a, b) => b.count - a.count);
-
     const alerts: HomeDashboardDto['alerts'] = [];
     if (staleDeals.length) {
       const first = staleDeals[0]!;
@@ -2067,30 +1858,11 @@ export class ReportsService {
           changePercent: pctChange(openActivitiesToday, openActivitiesYesterday),
           changeLabel: 'نسبت به دیروز',
         },
-        {
-          key: 'win-rate',
-          label: 'نرخ برد',
-          value: winRate,
-          changePercent: null,
-          changeLabel: '۱۲ ماه اخیر',
-        },
-        {
-          key: 'overdue',
-          label: 'عقب‌افتاده',
-          value: overdueCount,
-          changePercent: null,
-          changeLabel: 'فعالیت باز',
-        },
       ],
       alerts,
       salesTrend,
-      customerGrowth,
       sources,
       topCustomers,
-      salesSummary,
-      funnel,
-      lostReasons,
-      activityByType,
     };
   }
 }
@@ -2148,21 +1920,6 @@ function normalizeSource(raw: string | null | undefined): string {
   return map[value.toLowerCase()] ?? value;
 }
 
-function normalizeImportSource(raw: string | null | undefined): string {
-  const value = raw?.trim().toLowerCase();
-  if (!value) return 'سایر';
-  const map: Record<string, string> = {
-    manual: 'دستی',
-    tahesab: 'ته‌حساب',
-    didar: 'دیدار',
-    excel: 'اکسل',
-    phone: 'تلفن',
-    lead_form: 'فرم لید',
-    other: 'سایر',
-  };
-  return map[value] ?? normalizeSource(raw);
-}
-
 function normalizeLostReason(raw: string | null | undefined): string {
   const value = raw?.trim();
   if (!value) return 'بدون دلیل ثبت‌شده';

apps/api/src/routines/routine-mapper.ts

@@ -185,6 +185,7 @@ export function toRoutineDto(
     entityLink: normalizeEntityLink(row.entityLink),
     reminderMinutesBefore: row.reminderMinutesBefore,
     isActive: row.isActive,
+    createdById: row.createdById,
     recurrenceLabel: describeRecurrence(rule),
     executionRate: execution.total ? Math.round((execution.done / execution.total) * 100) : null,
     executionTotal: execution.total,

apps/api/src/routines/routines.service.ts

@@ -200,8 +200,7 @@ export class RoutinesService {
 
   async create(actor: Actor, dto: SaveRoutineDto): Promise<RoutineDto> {
     const scope = await this.scope(actor);
-    assertManager(scope);
-    const data = await this.buildData(actor, scope, dto);
+    const data = await this.buildData(actor, scope, this.ownRoutineInput(actor, scope, dto));
     const row = await this.prisma.routine.create({
       data: {
         ...data,
@@ -216,10 +215,9 @@ export class RoutinesService {
 
   async update(actor: Actor, id: string, dto: SaveRoutineDto): Promise<RoutineDto> {
     const scope = await this.scope(actor);
-    assertManager(scope);
     const existing = await this.findRoutine(actor.organizationId, id);
-    this.assertCanManageRoutine(scope, existing);
-    const data = await this.buildData(actor, scope, dto);
+    this.assertCanWriteRoutine(scope, existing);
+    const data = await this.buildData(actor, scope, this.ownRoutineInput(actor, scope, dto));
     const row = await this.prisma.routine.update({
       where: { id },
       data: data as Prisma.RoutineUncheckedUpdateInput,
@@ -232,9 +230,8 @@ export class RoutinesService {
 
   async toggle(actor: Actor, id: string, isActive: boolean): Promise<RoutineDto> {
     const scope = await this.scope(actor);
-    assertManager(scope);
     const existing = await this.findRoutine(actor.organizationId, id);
-    this.assertCanManageRoutine(scope, existing);
+    this.assertCanWriteRoutine(scope, existing);
     const row = await this.prisma.routine.update({
       where: { id },
       data: { isActive },
@@ -251,9 +248,8 @@ export class RoutinesService {
     dto: ChangeRoutineAssigneeDto,
   ): Promise<RoutineDto> {
     const scope = await this.scope(actor);
-    assertManager(scope);
     const existing = await this.findRoutine(actor.organizationId, id);
-    this.assertCanManageRoutine(scope, existing);
+    this.assertCanWriteRoutine(scope, existing);
     const target = await this.resolveTarget(actor, scope, dto.assigneeId, dto.teamId);
     await this.cancelTodayPending(id, 'تغییر مسئول روتین');
     const row = await this.prisma.routine.update({
@@ -268,9 +264,8 @@ export class RoutinesService {
 
   async duplicate(actor: Actor, id: string): Promise<RoutineDto> {
     const scope = await this.scope(actor);
-    assertManager(scope);
     const src = await this.findRoutine(actor.organizationId, id);
-    this.assertCanManageRoutine(scope, src);
+    this.assertCanWriteRoutine(scope, src);
     const {
       id: _id,
       createdAt: _c,
@@ -295,9 +290,8 @@ export class RoutinesService {
 
   async remove(actor: Actor, id: string) {
     const scope = await this.scope(actor);
-    assertManager(scope);
     const existing = await this.findRoutine(actor.organizationId, id);
-    this.assertCanManageRoutine(scope, existing);
+    this.assertCanWriteRoutine(scope, existing);
     await this.prisma.routine.update({
       where: { id },
       data: { deletedAt: new Date(), isActive: false },
@@ -345,6 +339,27 @@ export class RoutinesService {
     return row;
   }
 
+  /** عضو عادی فقط روتینی را می‌نویسد که خودش برای خودش ساخته است. */
+  private ownRoutineInput(actor: Actor, scope: RoutineScope, dto: SaveRoutineDto): SaveRoutineDto {
+    if (scope.isManager) return dto;
+    if (dto.teamId || (dto.assigneeId && dto.assigneeId !== actor.userId)) {
+      throw new ForbiddenException('فقط می‌توانید برای خودتان روتین بسازید');
+    }
+    return { ...dto, assigneeId: actor.userId, teamId: null };
+  }
+
+  private assertCanWriteRoutine(
+    scope: RoutineScope,
+    row: { assigneeId: string | null; teamId: string | null; createdById: string | null },
+  ) {
+    if (scope.isManager) {
+      this.assertCanManageRoutine(scope, row);
+      return;
+    }
+    if (row.createdById === scope.userId && row.assigneeId === scope.userId && !row.teamId) return;
+    throw new ForbiddenException('فقط روتینی که برای خودتان ساخته‌اید را می‌توانید تغییر دهید');
+  }
+
   private assertCanManageRoutine(
     scope: RoutineScope,
     row: { assigneeId: string | null; teamId: string | null; createdById: string | null },

apps/api/src/treasury/invoice-ledger.ts

@@ -0,0 +1,212 @@
+import { Prisma } from '@prisma/client';
+import { PrismaService } from '../prisma/prisma.service';
+
+const OPEN_INVOICE_STATUSES = ['issued', 'partially_paid', 'paid'] as const;
+
+export type InvoicePartyPosition = {
+  key: string;
+  partyKind: 'person' | 'company';
+  partyName: string;
+  /** فاکتورهای عادی به‌علاوهٔ ماندهٔ اول دورهٔ مثبت */
+  billed: Prisma.Decimal;
+  /** برگشتی‌ها و اضافه‌دریافت، برای ستون تسویه‌شدهٔ بدهکار */
+  offset: Prisma.Decimal;
+  /** مثبت = طلب ما، منفی = بدهی ما */
+  net: Prisma.Decimal;
+};
+
+type Bucket = {
+  key: string;
+  partyKind: 'person' | 'company';
+  partyName: string;
+  sales: Prisma.Decimal;
+  credits: Prisma.Decimal;
+  paid: Prisma.Decimal;
+  opening: Prisma.Decimal;
+};
+
+function zero() {
+  return new Prisma.Decimal(0);
+}
+
+function round2(value: Prisma.Decimal) {
+  return value.toDecimalPlaces(2);
+}
+
+/** همان فرمول ماندهٔ فاکتور: جمع ردیف‌ها − تخفیف + مالیات، برگشتی منفی. */
+export function signedInvoicePayable(invoice: {
+  kind: string;
+  discountAmount: Prisma.Decimal;
+  taxPercent: Prisma.Decimal;
+  lineItems: Array<{ quantity: Prisma.Decimal; unitPrice: Prisma.Decimal }>;
+}) {
+  const subtotal = invoice.lineItems.reduce(
+    (sum, line) => sum.plus(line.quantity.mul(line.unitPrice)),
+    zero(),
+  );
+  const discount = invoice.discountAmount ?? zero();
+  const taxable = Prisma.Decimal.max(subtotal.minus(discount), 0);
+  const tax = taxable.mul(invoice.taxPercent ?? 0).div(100);
+  const signed = round2(subtotal.minus(discount).plus(tax));
+  return invoice.kind === 'credit' ? signed.neg() : signed;
+}
+
+export async function internalBooksEnabled(prisma: PrismaService, organizationId: string) {
+  const connections = await prisma.accountingConnection.count({
+    where: { organizationId, enabled: true },
+  });
+  return connections === 0;
+}
+
+/**
+ * ماندهٔ طرف‌حساب از فاکتور صادرشده و ماندهٔ اول دوره.
+ * سند درآمد جدا ساخته نمی‌شود تا همان فروش دو بار طلب نشود.
+ * اگر حسابداری بیرونی وصل باشد، خالی برمی‌گردد.
+ */
+export async function loadInvoicePartyPositions(
+  prisma: PrismaService,
+  organizationId: string,
+): Promise<InvoicePartyPosition[]> {
+  if (!(await internalBooksEnabled(prisma, organizationId))) return [];
+
+  const [invoices, openings] = await Promise.all([
+    prisma.invoice.findMany({
+      where: { organizationId, status: { in: [...OPEN_INVOICE_STATUSES] } },
+      select: {
+        kind: true,
+        discountAmount: true,
+        taxPercent: true,
+        personId: true,
+        companyId: true,
+        person: { select: { firstName: true, lastName: true } },
+        company: { select: { name: true } },
+        lineItems: { select: { quantity: true, unitPrice: true } },
+        payments: { select: { amount: true } },
+      },
+    }),
+    prisma.partyOpeningBalance.findMany({
+      where: { organizationId },
+      select: {
+        personId: true,
+        amount: true,
+        person: { select: { firstName: true, lastName: true } },
+      },
+    }),
+  ]);
+
+  const buckets = new Map<string, Bucket>();
+  const ensure = (
+    key: string,
+    partyKind: 'person' | 'company',
+    partyName: string,
+  ) => {
+    const current = buckets.get(key);
+    if (current) return current;
+    const created: Bucket = {
+      key,
+      partyKind,
+      partyName,
+      sales: zero(),
+      credits: zero(),
+      paid: zero(),
+      opening: zero(),
+    };
+    buckets.set(key, created);
+    return created;
+  };
+
+  for (const invoice of invoices) {
+    const personId = invoice.personId;
+    const companyId = invoice.companyId;
+    const party = personId
+      ? {
+          key: `person:${personId}`,
+          partyKind: 'person' as const,
+          partyName:
+            `${invoice.person?.firstName ?? ''} ${invoice.person?.lastName ?? ''}`.trim() ||
+            'مشتری',
+        }
+      : companyId
+        ? {
+            key: `company:${companyId}`,
+            partyKind: 'company' as const,
+            partyName: invoice.company?.name?.trim() || 'شرکت',
+          }
+        : null;
+    if (!party) continue;
+    const bucket = ensure(party.key, party.partyKind, party.partyName);
+    const payable = signedInvoicePayable(invoice);
+    if (payable.greaterThan(0)) bucket.sales = bucket.sales.plus(payable);
+    else if (payable.lessThan(0)) bucket.credits = bucket.credits.plus(payable.abs());
+    const paid = invoice.payments.reduce((sum, row) => sum.plus(row.amount), zero());
+    bucket.paid = bucket.paid.plus(paid);
+  }
+
+  for (const opening of openings) {
+    if (opening.amount.equals(0)) continue;
+    const bucket = ensure(
+      `person:${opening.personId}`,
+      'person',
+      `${opening.person.firstName} ${opening.person.lastName}`.trim() || 'مشتری',
+    );
+    bucket.opening = bucket.opening.plus(opening.amount);
+  }
+
+  const positions: InvoicePartyPosition[] = [];
+  for (const bucket of buckets.values()) {
+    const net = round2(
+      bucket.opening.plus(bucket.sales).minus(bucket.credits).minus(bucket.paid),
+    );
+    if (net.equals(0)) continue;
+    const billed = round2(bucket.sales.plus(Prisma.Decimal.max(bucket.opening, 0)));
+    const offset = round2(billed.minus(net));
+    positions.push({
+      key: bucket.key,
+      partyKind: bucket.partyKind,
+      partyName: bucket.partyName,
+      billed,
+      offset: Prisma.Decimal.max(offset, 0),
+      net,
+    });
+  }
+  return positions;
+}
+
+/** فروش و برگشتیِ فاکتورهای صادرشده در بازه. وجه نقد را دوباره جمع نمی‌کند. */
+export async function invoiceSalesInPeriod(
+  prisma: PrismaService,
+  organizationId: string,
+  from: Date | null,
+  to: Date | null,
+) {
+  const empty = { sales: '0.00', credits: '0.00', net: '0.00' };
+  if (!(await internalBooksEnabled(prisma, organizationId))) return empty;
+
+  const invoices = await prisma.invoice.findMany({
+    where: { organizationId, status: { in: [...OPEN_INVOICE_STATUSES] } },
+    select: {
+      kind: true,
+      discountAmount: true,
+      taxPercent: true,
+      issuedAt: true,
+      createdAt: true,
+      lineItems: { select: { quantity: true, unitPrice: true } },
+    },
+  });
+
+  let sales = zero();
+  let credits = zero();
+  for (const invoice of invoices) {
+    const when = invoice.issuedAt ?? invoice.createdAt;
+    if (from && when < from) continue;
+    if (to && when > to) continue;
+    const payable = signedInvoicePayable(invoice);
+    if (payable.greaterThan(0)) sales = sales.plus(payable);
+    else if (payable.lessThan(0)) credits = credits.plus(payable.abs());
+  }
+  return {
+    sales: round2(sales).toFixed(2),
+    credits: round2(credits).toFixed(2),
+    net: round2(sales.minus(credits)).toFixed(2),
+  };
+}

apps/api/src/treasury/treasury-access.guard.ts

@@ -1,29 +1,84 @@
 import { CanActivate, ExecutionContext, ForbiddenException, Injectable } from '@nestjs/common';
-import { PrismaService } from '../prisma/prisma.service';
+import {
+  parseUserTreasuryAccess,
+  permissionsWithTreasuryOverride,
+  treasurySectionAllowed,
+  type TreasurySectionKey,
+} from '@mento/shared';
 import type { Actor } from '../common/record-scope';
+import { PrismaService } from '../prisma/prisma.service';
 
+/**
+ * حقوق فقط با treasury_payroll.
+ * بقیه مسیرها با treasury باز می‌شوند؛ اگر بخش ریز انتخاب شده باشد فقط همان‌ها.
+ */
 @Injectable()
 export class TreasuryAccessGuard implements CanActivate {
   constructor(private readonly prisma: PrismaService) {}
 
   async canActivate(context: ExecutionContext): Promise<boolean> {
-    const req = context.switchToHttp().getRequest<{ user?: Actor; originalUrl?: string; url?: string }>();
+    const req = context.switchToHttp().getRequest<{
+      user?: Actor;
+      method?: string;
+      originalUrl?: string;
+      url?: string;
+    }>();
     const actor = req.user;
     if (!actor) throw new ForbiddenException('دسترسی مالی مجاز نیست.');
-    const url = req.originalUrl || req.url || '';
-    const payroll = url.includes('/treasury/payroll');
     if (actor.role === 'owner' || actor.role === 'admin') return true;
     const membership = await this.prisma.membership.findFirst({
       where: { userId: actor.userId, organizationId: actor.organizationId, isActive: true },
-      select: { orgRole: { select: { permissions: true } } },
+      select: {
+        orgRole: { select: { permissions: true } },
+        treasuryAccessOverride: true,
+      },
     });
-    const permissions = Array.isArray(membership?.orgRole?.permissions)
+    const rolePermissions = Array.isArray(membership?.orgRole?.permissions)
       ? membership.orgRole.permissions.map(String)
       : [];
-    const allowed = payroll
-      ? permissions.includes('treasury_payroll')
-      : permissions.includes('treasury') || permissions.includes('treasury_payroll');
-    if (!allowed) throw new ForbiddenException('دسترسی مالی برای نقش شما مجاز نیست.');
+    const permissions = permissionsWithTreasuryOverride(
+      rolePermissions,
+      parseUserTreasuryAccess(membership?.treasuryAccessOverride),
+    );
+    const method = (req.method || 'GET').toUpperCase();
+    const url = req.originalUrl || req.url || '';
+    if (
+      isLookupForDocuments(method, url) &&
+      treasurySectionAllowed(actor.role, permissions, 'treasury_documents')
+    ) {
+      return true;
+    }
+    if (!treasurySectionAllowed(actor.role, permissions, sectionForUrl(url))) {
+      throw new ForbiddenException('به این بخش مدیریت مالی دسترسی ندارید.');
+    }
     return true;
   }
 }
+
+/** فهرست حساب و دسته برای ثبت سند لازم است؛ صفحهٔ مدیریت‌شان جدا می‌ماند. */
+function isLookupForDocuments(method: string, url: string): boolean {
+  if (method !== 'GET' && method !== 'HEAD') return false;
+  const path = (url.split('?')[0] || '').replace(/\/+$/, '');
+  return path.endsWith('/treasury/accounts') || path.endsWith('/treasury/categories');
+}
+
+function sectionForUrl(url: string): TreasurySectionKey | 'treasury_documents' {
+  if (url.includes('/treasury/payroll')) return 'treasury_payroll';
+  if (url.includes('/treasury/receivables') || url.includes('/treasury/installments')) {
+    return 'treasury_receivables';
+  }
+  if (url.includes('/treasury/recurring')) return 'treasury_recurring';
+  if (url.includes('/treasury/reports')) return 'treasury_reports';
+  if (url.includes('/treasury/audit')) return 'treasury_audit';
+  if (url.includes('/treasury/categories')) return 'treasury_categories';
+  if (
+    url.includes('/treasury/accounts') ||
+    url.includes('/treasury/transfers') ||
+    url.includes('/treasury/reconciliations') ||
+    url.includes('/treasury/adjustments')
+  ) {
+    return 'treasury_accounts';
+  }
+  if (url.includes('/treasury/dashboard')) return 'treasury_dashboard';
+  return 'treasury_documents';
+}

apps/api/src/treasury/treasury-ops.service.ts

@@ -2,8 +2,10 @@ import { BadRequestException, Injectable, Logger, NotFoundException } from '@nes
 import { Cron } from '@nestjs/schedule';
 import { Prisma } from '@prisma/client';
 import ExcelJS from 'exceljs';
+import type { TreasuryPartyBalanceDto } from '@mento/shared';
 import { PrismaService } from '../prisma/prisma.service';
 import type { Actor } from '../common/record-scope';
+import { invoiceSalesInPeriod } from './invoice-ledger';
 
 function dec(value: Prisma.Decimal | number | string | null | undefined) {
   return new Prisma.Decimal(value ?? 0);
@@ -11,11 +13,20 @@ function dec(value: Prisma.Decimal | number | string | null | undefined) {
 function money(value: Prisma.Decimal | number | string) {
   return new Prisma.Decimal(value).toFixed(2);
 }
+function reasonText(value?: string | null) {
+  const text = value?.trim() ?? '';
+  return text ? text.slice(0, 500) : null;
+}
 function parseDate(iso?: string | null) {
   if (!iso) return null;
   const d = new Date(iso);
   return Number.isNaN(d.getTime()) ? null : d;
 }
+function payrollStatus(payable: Prisma.Decimal, paid: Prisma.Decimal) {
+  if (paid.lessThanOrEqualTo(0)) return 'open';
+  if (paid.greaterThanOrEqualTo(payable)) return 'settled';
+  return 'partial';
+}
 function periodKey(date: Date) {
   return date.toISOString().slice(0, 10);
 }
@@ -35,9 +46,15 @@ export class TreasuryOpsService {
   async listPayroll(actor: Actor) {
     const rows = await this.prisma.financialPayroll.findMany({
       where: { organizationId: actor.organizationId },
-      include: { movements: true },
+      include: {
+        movements: {
+          where: { voidedAt: null },
+          include: { account: { select: { name: true } } },
+          orderBy: { occurredAt: 'desc' },
+        },
+      },
       orderBy: { dueDate: 'desc' },
-      take: 100,
+      take: 500,
     });
     const users = await this.prisma.user.findMany({
       where: { id: { in: rows.map((row) => row.userId) } },
@@ -54,8 +71,11 @@ export class TreasuryOpsService {
       period: string;
       baseAmount: string | number;
       benefits?: string | number;
+      benefitsReason?: string | null;
       bonus?: string | number;
+      bonusReason?: string | null;
       deductions?: string | number;
+      deductionsReason?: string | null;
       dueDate?: string;
       notes?: string | null;
     },
@@ -80,14 +100,23 @@ export class TreasuryOpsService {
         period: input.period.trim(),
         baseAmount: base,
         benefits,
+        benefitsReason: benefits.greaterThan(0) ? reasonText(input.benefitsReason) : null,
         bonus,
+        bonusReason: bonus.greaterThan(0) ? reasonText(input.bonusReason) : null,
         deductions,
+        deductionsReason: deductions.greaterThan(0) ? reasonText(input.deductionsReason) : null,
         payable,
         dueDate: parseDate(input.dueDate) ?? new Date(),
         notes: input.notes?.trim() || null,
         createdById: actor.userId,
       },
-      include: { movements: true },
+      include: {
+        movements: {
+          where: { voidedAt: null },
+          include: { account: { select: { name: true } } },
+          orderBy: { occurredAt: 'desc' },
+        },
+      },
     });
     const user = await this.prisma.user.findUnique({ where: { id: row.userId }, select: { fullName: true } });
     return this.payrollDto(row, user?.fullName ?? '');
@@ -123,7 +152,7 @@ export class TreasuryOpsService {
     if (!account) throw new BadRequestException('حساب پرداخت پیدا نشد.');
     const balance = await this.balance(account.id);
     if (balance.lessThan(amount)) throw new BadRequestException('موجودی حساب کافی نیست.');
-    const status = paid.plus(amount).equals(row.payable) ? 'settled' : 'partial';
+    const status = payrollStatus(row.payable, paid.plus(amount));
     await this.prisma.$transaction([
       this.prisma.financialMovement.create({
         data: {
@@ -144,6 +173,123 @@ export class TreasuryOpsService {
     return this.listPayroll(actor);
   }
 
+  async updatePayroll(
+    actor: Actor,
+    id: string,
+    input: {
+      userId: string;
+      period: string;
+      baseAmount: string | number;
+      benefits?: string | number;
+      benefitsReason?: string | null;
+      bonus?: string | number;
+      bonusReason?: string | null;
+      deductions?: string | number;
+      deductionsReason?: string | null;
+    },
+  ) {
+    const row = await this.prisma.financialPayroll.findFirst({
+      where: { id, organizationId: actor.organizationId },
+      include: { movements: true },
+    });
+    if (!row || row.voidedAt || row.status === 'void') {
+      throw new NotFoundException('رکورد حقوق برای ویرایش پیدا نشد.');
+    }
+    const base = dec(input.baseAmount);
+    const benefits = dec(input.benefits ?? 0);
+    const bonus = dec(input.bonus ?? 0);
+    const deductions = dec(input.deductions ?? 0);
+    const payable = base.plus(benefits).plus(bonus).minus(deductions);
+    if (!input.userId || !input.period?.trim()) {
+      throw new BadRequestException('پرسنل و دوره حقوق لازم است.');
+    }
+    if (!payable.greaterThan(0)) throw new BadRequestException('مبلغ قابل پرداخت باید بزرگ‌تر از صفر باشد.');
+    const paid = this.paidOf(row.movements);
+    if (payable.lessThan(paid)) {
+      throw new BadRequestException('مبلغ قابل پرداخت از پرداخت‌های ثبت‌شده کمتر است.');
+    }
+    const member = await this.prisma.membership.findFirst({
+      where: { organizationId: actor.organizationId, userId: input.userId, isActive: true },
+    });
+    if (!member) throw new BadRequestException('این کاربر عضو محیط نیست.');
+    try {
+      await this.prisma.financialPayroll.update({
+        where: { id: row.id },
+        data: {
+          userId: input.userId,
+          period: input.period.trim(),
+          baseAmount: base,
+          benefits,
+          benefitsReason: benefits.greaterThan(0) ? reasonText(input.benefitsReason) : null,
+          bonus,
+          bonusReason: bonus.greaterThan(0) ? reasonText(input.bonusReason) : null,
+          deductions,
+          deductionsReason: deductions.greaterThan(0) ? reasonText(input.deductionsReason) : null,
+          payable,
+          status: payrollStatus(payable, paid),
+        },
+      });
+    } catch (error) {
+      if (error instanceof Prisma.PrismaClientKnownRequestError && error.code === 'P2002') {
+        throw new BadRequestException('برای این پرسنل در این دوره حقوق ثبت شده است.');
+      }
+      throw error;
+    }
+    return this.listPayroll(actor);
+  }
+
+  async updatePayrollPayment(
+    actor: Actor,
+    payrollId: string,
+    movementId: string,
+    input: { amount: string | number; accountId: string; occurredAt?: string },
+  ) {
+    const movement = await this.prisma.financialMovement.findFirst({
+      where: {
+        id: movementId,
+        payrollId,
+        organizationId: actor.organizationId,
+        voidedAt: null,
+      },
+    });
+    const payroll = await this.prisma.financialPayroll.findFirst({
+      where: { id: payrollId, organizationId: actor.organizationId },
+      include: { movements: true },
+    });
+    if (!movement || !payroll || payroll.voidedAt || payroll.status === 'void') {
+      throw new NotFoundException('پرداخت حقوق برای ویرایش پیدا نشد.');
+    }
+    const amount = dec(input.amount);
+    const otherPaid = this.paidOf(payroll.movements.filter((item) => item.id !== movement.id));
+    if (!amount.greaterThan(0) || otherPaid.plus(amount).greaterThan(payroll.payable)) {
+      throw new BadRequestException('مبلغ پرداخت حقوق نامعتبر است.');
+    }
+    const account = await this.prisma.financialAccount.findFirst({
+      where: { id: input.accountId, organizationId: actor.organizationId },
+    });
+    if (!account || (!account.isActive && account.id !== movement.accountId)) {
+      throw new BadRequestException('حساب پرداخت پیدا نشد.');
+    }
+    const available = await this.balance(account.id);
+    const room = account.id === movement.accountId ? available.plus(movement.amount) : available;
+    if (room.lessThan(amount)) throw new BadRequestException('موجودی حساب کافی نیست.');
+    await this.prisma.$transaction([
+      this.prisma.financialMovement.update({
+        where: { id: movement.id },
+        data: {
+          accountId: account.id,
+          amount,
+          occurredAt: parseDate(input.occurredAt) ?? movement.occurredAt,
+        },
+      }),
+      this.prisma.financialPayroll.update({
+        where: { id: payroll.id },
+        data: { status: payrollStatus(payroll.payable, otherPaid.plus(amount)) },
+      }),
+    ]);
+    return this.listPayroll(actor);
+  }
+
   async listRecurring(actor: Actor) {
     const rows = await this.prisma.financialRecurringItem.findMany({
       where: { organizationId: actor.organizationId },
@@ -314,13 +460,20 @@ export class TreasuryOpsService {
     return { from: from.toISOString(), to: to.toISOString(), current, previous, ...breakdown };
   }
 
-  async reportExcel(actor: Actor, from?: string, to?: string) {
+  async reportExcel(
+    actor: Actor,
+    from?: string,
+    to?: string,
+    parties?: { debtors: TreasuryPartyBalanceDto[]; creditors: TreasuryPartyBalanceDto[] },
+  ) {
     const data = await this.report(actor, from, to);
     const book = new ExcelJS.Workbook();
     const sheet = book.addWorksheet('گزارش مالی');
     sheet.addRow(['شاخص', 'این دوره', 'دوره قبل']);
     const rows: Array<[string, string, string]> = [
       ['درآمد ثبت‌شده', data.current.bookedIncome, data.previous.bookedIncome],
+      ['فروش فاکتور', data.current.invoiceSales, data.previous.invoiceSales],
+      ['فاکتور برگشتی', data.current.invoiceCredits, data.previous.invoiceCredits],
       ['هزینه ثبت‌شده', data.current.bookedExpense, data.previous.bookedExpense],
       ['سود عملیاتی', data.current.operatingProfit, data.previous.operatingProfit],
       ['ورود وجه', data.current.cashIn, data.previous.cashIn],
@@ -331,10 +484,41 @@ export class TreasuryOpsService {
     sheet.addRow([]);
     sheet.addRow(['دسته هزینه', 'مبلغ', 'سهم']);
     data.current.expenseCategories.forEach((row) => sheet.addRow([row.name, row.amount, row.share]));
+    if (parties) {
+      this.addPartySheet(book, 'بدهکاران', parties.debtors, 'دریافت‌شده');
+      this.addPartySheet(book, 'بستانکاران', parties.creditors, 'پرداخت‌شده');
+    }
     const buffer = await book.xlsx.writeBuffer();
     return Buffer.from(buffer);
   }
 
+  private addPartySheet(
+    book: ExcelJS.Workbook,
+    title: string,
+    rows: TreasuryPartyBalanceDto[],
+    settledLabel: string,
+  ) {
+    const sheet = book.addWorksheet(title);
+    const kindLabel: Record<string, string> = { person: 'مشتری', company: 'شرکت', user: 'کاربر' };
+    sheet.addRow(['طرف حساب', 'نوع', 'مبلغ کل', settledLabel, 'مانده']);
+    let amount = new Prisma.Decimal(0);
+    let settled = new Prisma.Decimal(0);
+    let remaining = new Prisma.Decimal(0);
+    for (const row of rows) {
+      sheet.addRow([
+        row.partyName,
+        (row.partyKind && kindLabel[row.partyKind]) || 'ثبت قبلی',
+        row.amount,
+        row.settledAmount,
+        row.remaining,
+      ]);
+      amount = amount.plus(row.amount);
+      settled = settled.plus(row.settledAmount);
+      remaining = remaining.plus(row.remaining);
+    }
+    sheet.addRow(['جمع', '', money(amount), money(settled), money(remaining)]);
+  }
+
   private async period(organizationId: string, from: Date, to: Date) {
     const docs = await this.prisma.financialDocument.findMany({
       where: {
@@ -374,10 +558,15 @@ export class TreasuryOpsService {
       amount: money(amount),
       share: bookedExpense.equals(0) ? '0' : amount.div(bookedExpense).mul(100).toFixed(1),
     }));
+    const invoiceSales = await invoiceSalesInPeriod(this.prisma, organizationId, from, to);
     return {
       bookedIncome: money(bookedIncome),
+      invoiceSales: invoiceSales.sales,
+      invoiceCredits: invoiceSales.credits,
       bookedExpense: money(bookedExpense),
-      operatingProfit: money(bookedIncome.minus(bookedExpense)),
+      operatingProfit: money(
+        bookedIncome.plus(invoiceSales.net).minus(bookedExpense),
+      ),
       cashIn: money(cashIn),
       cashOut: money(cashOut),
       cashNet: money(cashIn.minus(cashOut)),
@@ -438,12 +627,22 @@ export class TreasuryOpsService {
       period: string;
       baseAmount: Prisma.Decimal;
       benefits: Prisma.Decimal;
+      benefitsReason?: string | null;
       bonus: Prisma.Decimal;
+      bonusReason?: string | null;
       deductions: Prisma.Decimal;
+      deductionsReason?: string | null;
       payable: Prisma.Decimal;
       dueDate: Date;
       status: string;
-      movements: Array<{ amount: Prisma.Decimal; voidedAt: Date | null }>;
+      movements: Array<{
+        id: string;
+        amount: Prisma.Decimal;
+        voidedAt: Date | null;
+        accountId: string;
+        occurredAt: Date;
+        account?: { name: string } | null;
+      }>;
     },
     fullName: string,
   ) {
@@ -456,13 +655,25 @@ export class TreasuryOpsService {
       period: row.period,
       baseAmount: money(row.baseAmount),
       benefits: money(row.benefits),
+      benefitsReason: row.benefitsReason?.trim() || null,
       bonus: money(row.bonus),
+      bonusReason: row.bonusReason?.trim() || null,
       deductions: money(row.deductions),
+      deductionsReason: row.deductionsReason?.trim() || null,
       payable: money(row.payable),
       paidAmount: money(paid),
       remaining: money(left.isNegative() ? 0 : left),
       dueDate: row.dueDate.toISOString(),
       status: row.status,
+      payments: row.movements
+        .filter((item) => !item.voidedAt)
+        .map((item) => ({
+          id: item.id,
+          amount: money(item.amount),
+          occurredAt: item.occurredAt.toISOString(),
+          accountId: item.accountId,
+          accountName: item.account?.name ?? '',
+        })),
     };
   }
 

apps/api/src/treasury/treasury.controller.ts

@@ -1,4 +1,4 @@
-import { Body, Controller, Get, Param, Patch, Post, Query, StreamableFile, UploadedFile, UseGuards, UseInterceptors } from '@nestjs/common';
+import { Body, Controller, Delete, Get, Param, Patch, Post, Query, StreamableFile, UploadedFile, UseGuards, UseInterceptors } from '@nestjs/common';
 import { FileInterceptor } from '@nestjs/platform-express';
 import { memoryStorage } from 'multer';
 import { JwtAuthGuard } from '../auth/jwt-auth.guard';
@@ -43,6 +43,20 @@ export class TreasuryController {
     return this.treasury.createCategory(user, body);
   }
 
+  @Patch('categories/:id')
+  updateCategory(
+    @CurrentUser() user: Actor,
+    @Param('id') id: string,
+    @Body() body: { name?: string; isActive?: boolean },
+  ) {
+    return this.treasury.updateCategory(user, id, body);
+  }
+
+  @Delete('categories/:id')
+  deleteCategory(@CurrentUser() user: Actor, @Param('id') id: string) {
+    return this.treasury.deleteCategory(user, id);
+  }
+
   @Get('accounts')
   accounts(
     @CurrentUser() user: Actor,
@@ -61,7 +75,18 @@ export class TreasuryController {
   updateAccount(
     @CurrentUser() user: Actor,
     @Param('id') id: string,
-    @Body() body: { name?: string; notes?: string | null; isActive?: boolean; responsibleName?: string | null },
+    @Body()
+    body: {
+      name?: string;
+      type?: 'bank' | 'cash' | 'petty';
+      bankName?: string | null;
+      accountRef?: string | null;
+      notes?: string | null;
+      isActive?: boolean;
+      responsibleName?: string | null;
+      openingBalance?: string | number;
+      openingDate?: string;
+    },
   ) {
     return this.treasury.updateAccount(user, id, body);
   }
@@ -81,6 +106,52 @@ export class TreasuryController {
     return this.treasury.transfer(user, body);
   }
 
+  @Get('parties')
+  parties(@CurrentUser() user: Actor, @Query('q') q?: string) {
+    return this.treasury.searchParties(user, q);
+  }
+
+  @Post('parties/person')
+  createPartyPerson(
+    @CurrentUser() user: Actor,
+    @Body() body: { firstName?: string; lastName?: string },
+  ) {
+    return this.treasury.createPartyPerson(user, body);
+  }
+
+  @Post('parties/company')
+  createPartyCompany(@CurrentUser() user: Actor, @Body() body: { name?: string }) {
+    return this.treasury.createPartyCompany(user, body);
+  }
+
+  @Get('party-balances')
+  partyBalances(@CurrentUser() user: Actor, @Query('kind') kind?: string) {
+    return this.treasury.partyBalances(user, kind === 'expense' ? 'expense' : 'income');
+  }
+
+  @Post('party-balances/collect')
+  collectPartyBalance(
+    @CurrentUser() user: Actor,
+    @Body()
+    body: {
+      kind?: string;
+      partyKind?: 'person' | 'company' | 'user';
+      partyId?: string;
+      amount?: string | number;
+      accountId?: string;
+      occurredAt?: string;
+    },
+  ) {
+    return this.treasury.collectPartyBalance(user, {
+      kind: body.kind === 'expense' ? 'expense' : 'income',
+      partyKind: body.partyKind ?? 'person',
+      partyId: body.partyId ?? '',
+      amount: body.amount ?? 0,
+      accountId: body.accountId ?? '',
+      occurredAt: body.occurredAt,
+    });
+  }
+
   @Get('documents')
   documents(
     @CurrentUser() user: Actor,
@@ -184,6 +255,25 @@ export class TreasuryController {
     return this.ops.createPayroll(user, body);
   }
 
+  @Patch('payroll/:id')
+  updatePayroll(
+    @CurrentUser() user: Actor,
+    @Param('id') id: string,
+    @Body() body: Parameters<TreasuryOpsService['updatePayroll']>[2],
+  ) {
+    return this.ops.updatePayroll(user, id, body);
+  }
+
+  @Patch('payroll/:id/payments/:movementId')
+  updatePayrollPayment(
+    @CurrentUser() user: Actor,
+    @Param('id') id: string,
+    @Param('movementId') movementId: string,
+    @Body() body: Parameters<TreasuryOpsService['updatePayrollPayment']>[3],
+  ) {
+    return this.ops.updatePayrollPayment(user, id, movementId, body);
+  }
+
   @Post('payroll/:id/pay')
   payPayroll(
     @CurrentUser() user: Actor,
@@ -221,7 +311,11 @@ export class TreasuryController {
     @Query('from') from?: string,
     @Query('to') to?: string,
   ) {
-    const buffer = await this.ops.reportExcel(user, from, to);
+    const [debtors, creditors] = await Promise.all([
+      this.treasury.partyBalances(user, 'income'),
+      this.treasury.partyBalances(user, 'expense'),
+    ]);
+    const buffer = await this.ops.reportExcel(user, from, to, { debtors, creditors });
     return new StreamableFile(buffer, {
       type: 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
       disposition: 'attachment; filename="treasury-report.xlsx"',

apps/api/src/treasury/treasury.module.ts

@@ -1,5 +1,6 @@
 import { Module } from '@nestjs/common';
 import { AuthModule } from '../auth/auth.module';
+import { ContactsModule } from '../contacts/contacts.module';
 import { NotificationsModule } from '../notifications/notifications.module';
 import { TreasuryController } from './treasury.controller';
 import { TreasuryAccessGuard } from './treasury-access.guard';
@@ -9,7 +10,7 @@ import { TreasuryReceivablesService } from './treasury-receivables.service';
 import { TreasuryService } from './treasury.service';
 
 @Module({
-  imports: [AuthModule, NotificationsModule],
+  imports: [AuthModule, NotificationsModule, ContactsModule],
   controllers: [TreasuryController],
   providers: [
     TreasuryService,

apps/api/src/users/dto.ts

@@ -128,4 +128,10 @@ export class UpdateUserDataAccessDto {
   @IsOptional()
   @IsObject()
   dataAccessOverride?: Record<string, unknown> | null;
+
+  /** null = ارث از نقش */
+  @ValidateIf((_, v) => v !== null)
+  @IsOptional()
+  @IsObject()
+  treasuryAccessOverride?: Record<string, unknown> | null;
 }

apps/api/src/users/users.service.ts

@@ -14,7 +14,12 @@ import type {
   UpdateUserVisibilityRequest,
   UserRole,
 } from '@mento/shared';
-import { DATA_SCOPES, DATA_VISIBILITIES, parseDataAccessPolicy } from '@mento/shared';
+import {
+  DATA_SCOPES,
+  DATA_VISIBILITIES,
+  parseDataAccessPolicy,
+  parseUserTreasuryAccess,
+} from '@mento/shared';
 import { resolveAllSectionAccess } from '../common/data-access';
 import { parseVisibilityScopes } from '../common/record-scope';
 import * as bcrypt from 'bcryptjs';
@@ -47,6 +52,7 @@ type MembershipRow = {
   dataVisibility?: string | null;
   dataVisibilityScopes?: unknown;
   dataAccessOverride?: unknown;
+  treasuryAccessOverride?: unknown;
   priorArchiveEnabled?: boolean;
   logoutTime?: string | null;
   blockLoginAfterLogout?: boolean;
@@ -98,8 +104,10 @@ export class UsersService {
       orgRoleId: dto.orgRoleId,
       role: dto.role,
     });
-    if (resolved.role === 'owner' && actorRole !== 'owner') {
-      throw new ForbiddenException('فقط مالک می‌تواند نقش مدیر سیستم را واگذار کند');
+    if (resolved.role === 'owner') {
+      throw new BadRequestException(
+        'هر محیط فقط یک مالک دارد و مالک همان کسی است که ثبت‌نام کرده. برای دسترسی کامل نقش مدیر را انتخاب کنید.',
+      );
     }
 
     const existingUser = await this.prisma.user.findFirst({ where: { mobile } });
@@ -370,23 +378,35 @@ export class UsersService {
     organizationId: string,
     actorRole: UserRole,
     targetId: string,
-    dto: { dataAccessOverride?: Record<string, unknown> | null },
+    dto: {
+      dataAccessOverride?: Record<string, unknown> | null;
+      treasuryAccessOverride?: Record<string, unknown> | null;
+    },
   ): Promise<OrgUserDto> {
     if (actorRole !== 'owner' && actorRole !== 'admin') {
       throw new ForbiddenException('اجازه تغییر محدوده داده را ندارید');
     }
-    if (dto.dataAccessOverride === undefined) {
+    if (dto.dataAccessOverride === undefined && dto.treasuryAccessOverride === undefined) {
       throw new BadRequestException('تغییری ارسال نشده است');
     }
     const target = await this.memberships.findUserInOrgById(organizationId, targetId);
     if (target.role === 'owner' || target.role === 'admin') {
       throw new BadRequestException('مالک و مدیر محدودیت عمق داده ندارند');
     }
-    const next =
-      dto.dataAccessOverride === null ? {} : parseDataAccessPolicy(dto.dataAccessOverride);
+    const data: Prisma.MembershipUpdateInput = {};
+    if (dto.dataAccessOverride !== undefined) {
+      data.dataAccessOverride =
+        dto.dataAccessOverride === null ? {} : parseDataAccessPolicy(dto.dataAccessOverride);
+    }
+    if (dto.treasuryAccessOverride !== undefined) {
+      data.treasuryAccessOverride =
+        dto.treasuryAccessOverride === null
+          ? Prisma.DbNull
+          : (parseUserTreasuryAccess(dto.treasuryAccessOverride) ?? Prisma.DbNull);
+    }
     await this.prisma.membership.update({
       where: { id: target.id },
-      data: { dataAccessOverride: next },
+      data,
     });
     return this.dtoOf(organizationId, targetId);
   }
@@ -431,6 +451,10 @@ export class UsersService {
       }
     }
 
+    if (nextRole === 'owner' && target.role !== 'owner') {
+      await this.memberships.assertSoleOwner(organizationId, target.userId);
+    }
+
     if (target.role === 'owner' && nextRole !== 'owner') {
       const owners = await this.memberships.countActiveOwners(
         organizationId,
@@ -438,7 +462,7 @@ export class UsersService {
       );
       if (owners < 1) {
         throw new BadRequestException(
-          'حداقل یک مالک برای سازمان لازم است؛ ابتدا مالک دیگری تعیین کنید',
+          'مالک محیط همان کسی است که ثبت‌نام کرده و نمی‌توان نقش او را عوض کرد',
         );
       }
     }
@@ -510,6 +534,9 @@ export class UsersService {
       }
     }
     if (isActive && !target.isActive) {
+      if (target.role === 'owner') {
+        await this.memberships.assertSoleOwner(organizationId, targetId);
+      }
       await this.billing.assertSeatAvailable(organizationId, targetId);
     }
     await this.prisma.membership.update({
@@ -540,6 +567,9 @@ export class UsersService {
     resolved: { role: UserRole; orgRoleId: string },
   ): Promise<OrgUserDto> {
     await this.billing.assertSeatAvailable(organizationId, userId);
+    if (resolved.role === 'owner') {
+      await this.memberships.assertSoleOwner(organizationId, userId);
+    }
     const existing = await this.prisma.membership.findFirst({
       where: { userId, organizationId },
     });
@@ -606,6 +636,10 @@ export class UsersService {
         row.role === 'owner' || row.role === 'admin'
           ? {}
           : parseDataAccessPolicy(row.dataAccessOverride),
+      treasuryAccessOverride:
+        row.role === 'owner' || row.role === 'admin'
+          ? null
+          : parseUserTreasuryAccess(row.treasuryAccessOverride),
       ...(() => {
         const effectiveDataAccess = resolveAllSectionAccess({
           role: row.role,

apps/api/test/record-scope.test.ts

@@ -1,6 +1,11 @@
 import { describe, it } from 'node:test';
 import assert from 'node:assert/strict';
-import { leadsDeepWhere, resolveSectionAccess } from '../src/common/data-access';
+import {
+  customersCompanyWhere,
+  customersPersonWhere,
+  leadsDeepWhere,
+  resolveSectionAccess,
+} from '../src/common/data-access';
 import {
   noteAccessWhere,
   normalizeDataVisibility,
@@ -122,3 +127,49 @@ describe('عمق داده وقتی نقش فقط بعضی بخش‌ها را ذ
     assert.deepEqual(leads.section, { mode: 'rules', rules: [{ owners: ['self'] }] });
   });
 });
+
+describe('مسئول گروه مشتری روی عمق داده', () => {
+  const selfAccess = { mode: 'rules' as const, rules: [{ owners: ['self' as const] }] };
+
+  it('محدودیت self با OR مسئول گروه برای شخص', () => {
+    const where = customersPersonWhere({
+      userId: 'u1',
+      role: 'sales',
+      customersAccess: selfAccess,
+      teamPeerIds: null,
+    });
+    assert.deepEqual(where, {
+      OR: [
+        { ownerId: 'u1' },
+        { groupLinks: { some: { group: { assignees: { some: { id: 'u1' } } } } } },
+      ],
+    });
+  });
+
+  it('محدودیت self با OR مسئول گروه برای شرکت', () => {
+    const where = customersCompanyWhere({
+      userId: 'u1',
+      role: 'sales',
+      customersAccess: selfAccess,
+      teamPeerIds: null,
+    });
+    assert.deepEqual(where, {
+      OR: [
+        { ownerId: 'u1' },
+        { groupLinks: { some: { group: { assignees: { some: { id: 'u1' } } } } } },
+      ],
+    });
+  });
+
+  it('بدون محدودیت عمقی، فیلتر اضافه نمی‌شود', () => {
+    assert.deepEqual(
+      customersPersonWhere({
+        userId: 'u1',
+        role: 'sales',
+        customersAccess: { mode: 'all', rules: [] },
+        teamPeerIds: null,
+      }),
+      {},
+    );
+  });
+});

apps/web/package.json

@@ -22,9 +22,7 @@
     "xlsx": "^0.18.5"
   },
   "devDependencies": {
-    "@tailwindcss/vite": "^4.3.3",
     "@vitejs/plugin-vue": "^5.2.3",
-    "tailwindcss": "^4.3.3",
     "typescript": "^5.8.2",
     "vite": "^6.2.2",
     "vue-tsc": "^2.2.8"

apps/web/src/components/AskMentoPanel.vue

@@ -4,20 +4,8 @@ import { RouterLink } from 'vue-router';
 import axios from 'axios';
 import { api } from '@/lib/api';
 import { rewriteGregorianDates } from '@/lib/jalali';
+import UiIcon from '@/components/UiIcon.vue';
 import { brand, type AskMentoResponse, type AskMentoSourceDto } from '@mento/shared';
-import {
-  Alert as AAlert,
-  Button as AButton,
-  Card as ACard,
-  Flex as AFlex,
-  Input as AInput,
-  Space as ASpace,
-  Tag as ATag,
-  Typography,
-} from 'ant-design-vue';
-import { ThunderboltOutlined } from '@ant-design/icons-vue';
-
-const { Paragraph: ATypographyParagraph } = Typography;
 
 const props = defineProps<{
   personId?: string;
@@ -77,53 +65,127 @@ function insertAnswer() {
 </script>
 
 <template>
-  <a-flex vertical :gap="8" :style="{ minWidth: 0 }">
-    <a-flex :gap="8" align="center" :style="{ width: '100%' }">
-      <a-input
-        v-model:value="question"
-        allow-clear
+  <section class="ask">
+    <form @submit.prevent="submit">
+      <UiIcon name="sparkle" :size="16" class="ico" />
+      <input
+        v-model="question"
+        type="search"
         :placeholder="placeholder || brand.askPlaceholderFa"
-        :style="{ flex: 1, minWidth: 0 }"
-        @pressEnter="submit"
-      >
-        <template #prefix>
-          <ThunderboltOutlined />
-        </template>
-      </a-input>
-      <a-button
-        type="primary"
-        :disabled="asking || question.trim().length < 2"
-        :loading="asking"
-        @click="submit"
-      >
-        بپرس
-      </a-button>
-    </a-flex>
-
-    <a-alert v-if="error" type="error" show-icon :message="error" />
-
-    <a-card v-else-if="result" :bordered="false">
-      <a-typography-paragraph :style="{ marginBottom: 0 }">
-        {{ result.answer }}
-      </a-typography-paragraph>
-      <a-space v-if="result.sources.length" wrap :size="6" :style="{ marginTop: '8px' }">
+      />
+      <button type="submit" :disabled="asking || question.trim().length < 2">
+        {{ asking ? '…' : 'بپرس' }}
+      </button>
+    </form>
+    <p v-if="error" class="error">{{ error }}</p>
+    <div v-else-if="result" class="answer">
+      <p>{{ result.answer }}</p>
+      <div v-if="result.sources.length" class="sources">
         <RouterLink
           v-for="source in result.sources"
           :key="`${source.type}-${source.id}`"
           :to="sourceTo(source)"
         >
-          <a-tag color="cyan" :bordered="false">{{ source.label }}</a-tag>
+          {{ source.label }}
         </RouterLink>
-      </a-space>
-      <a-button
+      </div>
+      <button
         v-if="allowInsert && result.answer.trim()"
-        type="primary"
-        block
-        :style="{ marginTop: '8px' }"
+        type="button"
+        class="insert-btn"
         @click="insertAnswer"
       >
         درج در پیام
-      </a-button>
-    </a-card>
-  </a-flex>
+      </button>
+    </div>
+  </section>
 </template>
+
+<style scoped>
+.ask {
+  display: grid;
+  gap: 0.55rem;
+  min-width: 0;
+}
+
+form {
+  display: flex;
+  align-items: center;
+  gap: 0.45rem;
+  background: #fff;
+  border: 1px solid #e2e8f0;
+  border-radius: var(--radius);
+  padding: 0.35rem 0.4rem 0.35rem 0.7rem;
+}
+
+.ico {
+  color: #0f766e;
+  flex-shrink: 0;
+}
+
+input {
+  flex: 1;
+  min-width: 0;
+  border: 0;
+  background: transparent;
+  font: inherit;
+  padding: 0.45rem 0;
+}
+
+button {
+  border: 0;
+  border-radius: var(--radius);
+  background: #14b8a6;
+  color: #fff;
+  font: inherit;
+  font-weight: 700;
+  padding: 0.45rem 0.8rem;
+  cursor: pointer;
+}
+
+button:disabled {
+  opacity: 0.55;
+  cursor: wait;
+}
+
+.answer {
+  background: #f0fdfa;
+  border-radius: var(--radius);
+  padding: 0.7rem 0.85rem;
+}
+
+.answer p {
+  margin: 0;
+  color: #134e4a;
+  font-size: 0.88rem;
+  line-height: 1.7;
+}
+
+.sources {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 0.35rem;
+  margin-top: 0.55rem;
+}
+
+.sources a {
+  font-size: 0.74rem;
+  font-weight: 700;
+  color: #0f766e;
+  background: #fff;
+  border-radius: 999px;
+  padding: 0.18rem 0.55rem;
+}
+
+.insert-btn {
+  margin-top: 0.65rem;
+  width: 100%;
+  background: #0f766e;
+}
+
+.error {
+  margin: 0;
+  color: #b91c1c;
+  font-size: 0.84rem;
+}
+</style>

apps/web/src/components/CustomerGroupsManager.vue

@@ -1,29 +1,54 @@
 <script setup lang="ts">
-import { ref, watch } from 'vue';
+import { computed, ref, watch } from 'vue';
 import axios from 'axios';
-import type { CustomerGroupColor, CustomerGroupDto } from '@mento/shared';
+import type { CustomerGroupColor, CustomerGroupDto, OrgUserDto } from '@mento/shared';
 import { CUSTOMER_GROUP_COLORS } from '@mento/shared';
 import { api } from '@/lib/api';
 import { toFaDigits } from '@/lib/jalali';
+import { normalizeSearchText } from '@/lib/search';
 import {
   CUSTOMER_GROUP_COLOR_LABELS,
   groupSwatch,
   useCustomerGroups,
 } from '@/lib/customer-groups';
+import { useAuthStore } from '@/stores/auth';
 import { UiButton, UiInput, UiModal } from '@/components/ui';
 import UiIcon from '@/components/UiIcon.vue';
+import OrgUserPersonPick from '@/components/OrgUserPersonPick.vue';
 
 const props = defineProps<{ open: boolean }>();
 const emit = defineEmits<{ close: []; changed: [] }>();
 
+const auth = useAuthStore();
+const canManage = computed(
+  () => auth.user?.role === 'owner' || auth.user?.role === 'admin',
+);
+
 const { groups, load } = useCustomerGroups();
+const users = ref<OrgUserDto[]>([]);
 const newName = ref('');
 const newColor = ref<CustomerGroupColor>('teal');
+const newAssigneeIds = ref<string[]>([]);
 const editingId = ref<string | null>(null);
 const editName = ref('');
+const assigneeDraft = ref<Record<string, string[]>>({});
+const listQuery = ref('');
 const busy = ref(false);
 const error = ref('');
 
+const filteredGroups = computed(() => {
+  const q = normalizeSearchText(listQuery.value);
+  if (!q) return groups.value;
+  return groups.value.filter((g) => {
+    const assigneeNames = (g.assignees ?? []).map((a) => a.fullName).join(' ');
+    return (
+      normalizeSearchText(g.name).includes(q) ||
+      normalizeSearchText(g.parentName ?? '').includes(q) ||
+      normalizeSearchText(assigneeNames).includes(q)
+    );
+  });
+});
+
 function errorText(e: unknown, fallback: string) {
   if (axios.isAxiosError(e)) {
     const msg = (e.response?.data as { message?: string | string[] } | undefined)?.message;
@@ -33,12 +58,30 @@ function errorText(e: unknown, fallback: string) {
   return fallback;
 }
 
+async function loadUsers() {
+  try {
+    const { data } = await api.get<OrgUserDto[]>('/users');
+    users.value = data.filter((u) => u.isActive !== false);
+  } catch {
+    users.value = [];
+  }
+}
+
+function syncAssigneeDraft() {
+  const next: Record<string, string[]> = {};
+  for (const g of groups.value) {
+    next[g.id] = (g.assignees ?? []).map((a) => a.id);
+  }
+  assigneeDraft.value = next;
+}
+
 async function run(task: () => Promise<unknown>, fallback: string) {
   busy.value = true;
   error.value = '';
   try {
     await task();
     await load(true);
+    syncAssigneeDraft();
     emit('changed');
     return true;
   } catch (e) {
@@ -53,10 +96,18 @@ async function create() {
   const name = newName.value.trim();
   if (!name) return;
   const ok = await run(
-    () => api.post('/customer-groups', { name, color: newColor.value }),
+    () =>
+      api.post('/customer-groups', {
+        name,
+        color: newColor.value,
+        assigneeIds: newAssigneeIds.value,
+      }),
     'ساخت گروه ناموفق بود.',
   );
-  if (ok) newName.value = '';
+  if (ok) {
+    newName.value = '';
+    newAssigneeIds.value = [];
+  }
 }
 
 function startEdit(g: CustomerGroupDto) {
@@ -82,6 +133,24 @@ async function setColor(g: CustomerGroupDto, color: CustomerGroupColor) {
   await run(() => api.patch(`/customer-groups/${g.id}`, { color }), 'تغییر رنگ ناموفق بود.');
 }
 
+async function onAssigneesChange(g: CustomerGroupDto, ids: string[]) {
+  assigneeDraft.value = { ...assigneeDraft.value, [g.id]: ids };
+  const prev = (g.assignees ?? []).map((a) => a.id).sort().join(',');
+  const next = [...ids].sort().join(',');
+  if (prev === next) return;
+  await run(
+    () => api.patch(`/customer-groups/${g.id}`, { assigneeIds: ids }),
+    'ذخیره مسئولان گروه ناموفق بود.',
+  );
+}
+
+function assigneeLabel(g: CustomerGroupDto) {
+  const names = (g.assignees ?? []).map((a) => a.fullName).filter(Boolean);
+  if (!names.length) return 'بدون مسئول';
+  if (names.length === 1) return names[0]!;
+  return `${names[0]} و ${toFaDigits(names.length - 1)} نفر دیگر`;
+}
+
 async function remove(g: CustomerGroupDto) {
   const used = g.personCount + g.companyCount;
   const note = used ? ` این گروه از ${toFaDigits(used)} مخاطب برداشته می‌شود (خود مخاطب‌ها حذف نمی‌شوند).` : '';
@@ -95,9 +164,12 @@ watch(
     if (!open) return;
     error.value = '';
     editingId.value = null;
-    void load(true).catch(() => {
-      error.value = 'بارگذاری گروه‌ها ناموفق بود.';
-    });
+    listQuery.value = '';
+    void Promise.all([load(true), loadUsers()])
+      .then(() => syncAssigneeDraft())
+      .catch(() => {
+        error.value = 'بارگذاری گروه‌ها ناموفق بود.';
+      });
   },
   { immediate: true },
 );
@@ -107,34 +179,60 @@ watch(
   <UiModal :open="open" title="گروه‌های مشتری" @close="emit('close')">
     <div class="manager">
       <p class="lead">
-        هر شخص یا شرکت می‌تواند چند گروه داشته باشد. گروه‌هایی که از ته‌حساب می‌آیند با برچسب
-        «ته‌حساب» مشخص شده‌اند.
+        هر شخص یا شرکت می‌تواند چند گروه داشته باشد. مسئولان گروه (اختیاری) اعضای آن گروه را مثل
+        مشتریان خود می‌بینند. گروه‌های ته‌حساب با برچسب «ته‌حساب» مشخص شده‌اند.
       </p>
 
-      <form class="new-row" @submit.prevent="create">
-        <UiInput v-model="newName" placeholder="نام گروه جدید" :maxlength="80" :disabled="busy" />
-        <div class="swatches">
-          <button
-            v-for="c in CUSTOMER_GROUP_COLORS"
-            :key="c"
-            type="button"
-            class="swatch"
-            :class="{ on: newColor === c }"
-            :style="{ background: groupSwatch(c).fg }"
-            :title="CUSTOMER_GROUP_COLOR_LABELS[c]"
-            @click="newColor = c"
+      <form v-if="canManage" class="create-panel" @submit.prevent="create">
+        <header class="create-head">
+          <strong>گروه جدید</strong>
+          <span>نام، رنگ و مسئولان را مشخص کنید و افزودن بزنید.</span>
+        </header>
+        <div class="new-row">
+          <UiInput v-model="newName" placeholder="نام گروه جدید" :maxlength="80" :disabled="busy" />
+          <div class="swatches">
+            <button
+              v-for="c in CUSTOMER_GROUP_COLORS"
+              :key="c"
+              type="button"
+              class="swatch"
+              :class="{ on: newColor === c }"
+              :style="{ background: groupSwatch(c).fg }"
+              :title="CUSTOMER_GROUP_COLOR_LABELS[c]"
+              @click="newColor = c"
+            />
+          </div>
+          <UiButton type="submit" variant="primary" size="sm" :disabled="busy || !newName.trim()">
+            <UiIcon name="plus" :size="15" />
+            افزودن
+          </UiButton>
+        </div>
+        <div v-if="users.length" class="assignee-field create-assignees">
+          <span class="assignees-label">مسئولان (اختیاری)</span>
+          <OrgUserPersonPick
+            v-model="newAssigneeIds"
+            :users="users"
+            :disabled="busy"
+            empty-label="انتخاب مسئول"
           />
         </div>
-        <UiButton type="submit" variant="primary" size="sm" :disabled="busy || !newName.trim()">
-          <UiIcon name="plus" :size="15" />
-          افزودن
-        </UiButton>
       </form>
 
       <p v-if="error" class="error">{{ error }}</p>
 
-      <ul v-if="groups.length" class="list">
-        <li v-for="g in groups" :key="g.id" class="row">
+      <div v-if="canManage || groups.length" class="list-head">
+        <h3 class="list-title">گروه‌های موجود</h3>
+        <label v-if="groups.length" class="list-search">
+          <UiIcon name="search" :size="15" />
+          <input
+            v-model="listQuery"
+            type="search"
+            placeholder="جستجوی گروه یا مسئول…"
+          />
+        </label>
+      </div>
+      <ul v-if="filteredGroups.length" class="list">
+        <li v-for="g in filteredGroups" :key="g.id" class="row">
           <div class="name-cell">
             <form v-if="editingId === g.id" class="edit" @submit.prevent="saveName(g)">
               <UiInput v-model="editName" :maxlength="80" :disabled="busy" />
@@ -152,9 +250,10 @@ watch(
               <span class="count">
                 {{ toFaDigits(g.personCount) }} شخص · {{ toFaDigits(g.companyCount) }} شرکت
               </span>
+              <span v-if="!canManage" class="assignee-summary">{{ assigneeLabel(g) }}</span>
             </template>
           </div>
-          <div v-if="editingId !== g.id" class="row-actions">
+          <div v-if="editingId !== g.id && canManage" class="row-actions">
             <div class="swatches">
               <button
                 v-for="c in CUSTOMER_GROUP_COLORS"
@@ -173,8 +272,20 @@ watch(
               <UiIcon name="trash" :size="14" />
             </UiButton>
           </div>
+          <div v-if="canManage && users.length" class="assignee-field">
+            <span class="assignees-label">مسئولان</span>
+            <OrgUserPersonPick
+              :model-value="assigneeDraft[g.id] ?? []"
+              :users="users"
+              :disabled="busy"
+              empty-label="انتخاب مسئول"
+              @update:model-value="(ids) => (assigneeDraft[g.id] = ids)"
+              @change="(ids) => onAssigneesChange(g, ids)"
+            />
+          </div>
         </li>
       </ul>
+      <p v-else-if="groups.length && listQuery.trim()" class="muted">گروهی با این جستجو پیدا نشد.</p>
       <p v-else class="muted">هنوز گروهی ساخته نشده است.</p>
     </div>
   </UiModal>
@@ -200,6 +311,78 @@ watch(
   font-size: 0.85rem;
 }
 
+.create-panel {
+  display: grid;
+  gap: 0.75rem;
+  padding: 0.85rem 0.95rem;
+  border: 1px solid color-mix(in srgb, var(--accent, #0d9488) 28%, #e2e8f0);
+  border-radius: 12px;
+  background:
+    linear-gradient(180deg, color-mix(in srgb, var(--accent, #0d9488) 8%, #fff) 0%, #fff 72%);
+  box-shadow: inset 0 1px 0 rgba(255, 255, 255, 0.7);
+}
+
+.create-head {
+  display: grid;
+  gap: 0.15rem;
+}
+
+.create-head strong {
+  color: var(--accent-deep, #0f766e);
+  font-size: 0.9rem;
+  font-weight: 700;
+}
+
+.create-head span {
+  color: #64748b;
+  font-size: 0.78rem;
+}
+
+.list-head {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  justify-content: space-between;
+  gap: 0.5rem;
+}
+
+.list-title {
+  margin: 0;
+  color: #475569;
+  font-size: 0.8rem;
+  font-weight: 700;
+}
+
+.list-search {
+  display: flex;
+  align-items: center;
+  gap: 0.4rem;
+  min-width: min(16rem, 100%);
+  flex: 1 1 12rem;
+  max-width: 18rem;
+  height: 2.25rem;
+  padding: 0 0.65rem;
+  border: 1px solid #e2e8f0;
+  border-radius: var(--radius, 10px);
+  background: #fff;
+  color: #94a3b8;
+}
+
+.list-search:focus-within {
+  border-color: #5eead4;
+}
+
+.list-search input {
+  flex: 1;
+  min-width: 0;
+  border: 0;
+  outline: none;
+  background: transparent;
+  font: inherit;
+  font-size: 0.85rem;
+  color: #0f172a;
+}
+
 .new-row,
 .edit {
   display: flex;
@@ -240,11 +423,9 @@ watch(
 .list {
   list-style: none;
   margin: 0;
-  padding: 0;
+  padding: 0 0 0.25rem;
   display: grid;
   gap: 0.4rem;
-  max-height: 55vh;
-  overflow-y: auto;
 }
 
 .row {
@@ -282,14 +463,38 @@ watch(
   padding: 0.05rem 0.4rem;
 }
 
-.count {
+.count,
+.assignee-summary {
   color: #94a3b8;
   font-size: 0.78rem;
 }
 
+.assignee-summary {
+  flex: 1 1 100%;
+}
+
 .row-actions {
   display: flex;
   align-items: center;
   gap: 0.35rem;
 }
+
+.assignee-field {
+  flex: 1 1 100%;
+  display: grid;
+  gap: 0.35rem;
+  padding-top: 0.35rem;
+  border-top: 1px dashed #e2e8f0;
+}
+
+.create-assignees {
+  border-top: 1px dashed color-mix(in srgb, var(--accent, #0d9488) 22%, #e2e8f0);
+  padding-top: 0.65rem;
+}
+
+.assignees-label {
+  font-size: 0.75rem;
+  color: #64748b;
+  font-weight: 600;
+}
 </style>

apps/web/src/components/DataAccessEditor.vue

@@ -22,7 +22,6 @@ const props = withDefaults(
   defineProps<{
     modelValue: SectionDataAccess;
     section?: DataAccessSection;
-    groups?: IdOption[];
     stages?: IdOption[];
     pipelines?: IdOption[];
     boards?: IdOption[];
@@ -36,7 +35,6 @@ const props = withDefaults(
   }>(),
   {
     section: 'customers',
-    groups: () => [],
     stages: () => [],
     pipelines: () => [],
     boards: () => [],
@@ -53,9 +51,9 @@ const emit = defineEmits<{
 
 const sectionLabel = computed(() => DATA_ACCESS_SECTION_LABELS[props.section]);
 
-const showGroups = computed(() => props.section === 'customers');
 const showMoods = computed(() => props.section === 'customers');
 const showImportSources = computed(() => props.section === 'customers');
+const isCustomers = computed(() => props.section === 'customers');
 const showLeadSources = computed(() => props.section === 'leads');
 const showNoteTypes = computed(() => props.section === 'notes');
 const showTicketStatuses = computed(() => props.section === 'tickets');
@@ -119,9 +117,8 @@ const boardsLegend = computed(() =>
 /** چند قانون قدیمی → یک فیلتر (اتحاد گزینه‌ها) برای ویرایش ساده */
 function collapseRules(rules: DataAccessRule[]): DataAccessRule {
   if (!rules.length) return {};
-  if (rules.length === 1) return { ...rules[0]! };
+  if (rules.length === 1) return stripCustomerGroupIds({ ...rules[0]! });
   const owners = new Set<DataAccessOwnerKind>();
-  const groupIds = new Set<string>();
   const sources = new Set<string>();
   const moods = new Set<PersonMood>();
   const stageIds = new Set<string>();
@@ -130,7 +127,6 @@ function collapseRules(rules: DataAccessRule[]): DataAccessRule {
   const typeIds = new Set<string>();
   for (const r of rules) {
     for (const o of r.owners ?? []) owners.add(o);
-    for (const id of r.groupIds ?? []) groupIds.add(id);
     for (const s of r.sources ?? []) sources.add(s);
     for (const m of r.moods ?? []) moods.add(m);
     for (const id of r.stageIds ?? []) stageIds.add(id);
@@ -140,7 +136,6 @@ function collapseRules(rules: DataAccessRule[]): DataAccessRule {
   }
   const out: DataAccessRule = {};
   if (owners.size) out.owners = [...owners];
-  if (groupIds.size) out.groupIds = [...groupIds];
   if (sources.size) out.sources = [...sources];
   if (moods.size) out.moods = [...moods];
   if (stageIds.size) out.stageIds = [...stageIds];
@@ -150,10 +145,17 @@ function collapseRules(rules: DataAccessRule[]): DataAccessRule {
   return out;
 }
 
+/** دسترسی گروه فقط از مسئول‌گروه؛ groupIds دیگر در فیلتر مشتریان ذخیره/نمایش نمی‌شود */
+function stripCustomerGroupIds(rule: DataAccessRule): DataAccessRule {
+  if (!isCustomers.value || !rule.groupIds?.length) return rule;
+  const { groupIds: _drop, ...rest } = rule;
+  return rest;
+}
+
 function ruleHasAnyFilter(rule: DataAccessRule): boolean {
   return Boolean(
     rule.owners?.length ||
-      rule.groupIds?.length ||
+      (!isCustomers.value && rule.groupIds?.length) ||
       rule.sources?.length ||
       rule.moods?.length ||
       rule.stageIds?.length ||
@@ -184,10 +186,26 @@ const mode = computed({
 
 const filter = computed(() => collapseRules(props.modelValue?.rules ?? []));
 
+/** پاک‌سازی groupIds قدیمی مشتریان هنگام باز شدن ویرایشگر */
+watch(
+  () => [props.section, props.modelValue] as const,
+  () => {
+    if (!isCustomers.value || props.modelValue?.mode !== 'rules') return;
+    const rules = props.modelValue.rules ?? [];
+    if (!rules.some((r) => r.groupIds?.length)) return;
+    const collapsed = collapseRules(rules);
+    emit('update:modelValue', {
+      mode: 'rules',
+      rules: [ruleHasAnyFilter(collapsed) ? collapsed : {}],
+    });
+  },
+  { immediate: true },
+);
+
 function emitFilter(next: DataAccessRule) {
   const cleaned: DataAccessRule = {};
   if (next.owners?.length) cleaned.owners = [...next.owners];
-  if (next.groupIds?.length) cleaned.groupIds = [...next.groupIds];
+  if (!isCustomers.value && next.groupIds?.length) cleaned.groupIds = [...next.groupIds];
   if (next.sources?.length) cleaned.sources = [...next.sources];
   if (next.moods?.length) cleaned.moods = [...next.moods];
   if (next.stageIds?.length) cleaned.stageIds = [...next.stageIds];
@@ -210,7 +228,6 @@ function toggleOwner(kind: DataAccessOwnerKind) {
 }
 
 type ListKey =
-  | 'groupIds'
   | 'sources'
   | 'moods'
   | 'stageIds'
@@ -293,16 +310,6 @@ const moodOptions: Choice[] = PERSON_MOODS.map((mood) => ({
 const pickers = computed((): Picker[] => {
   const rule = filter.value;
   const items: Picker[] = [];
-  if (showGroups.value) {
-    items.push({
-      key: 'groupIds',
-      legend: 'گروه‌ها',
-      mode: 'multiple',
-      placeholder: props.groups.length ? 'جستجو و انتخاب گروه…' : 'گروهی تعریف نشده',
-      notFound: props.groups.length ? 'موردی پیدا نشد' : 'گروهی تعریف نشده',
-      options: withSelected(namedOptions(props.groups), rule.groupIds),
-    });
-  }
   if (showImportSources.value) {
     const ready = props.importSourcesReady;
     const failed = props.importSourcesFailed;
@@ -417,7 +424,6 @@ const filterSummary = computed(() => {
   const parts: string[] = [];
   if (rule.owners?.includes('self')) parts.push(ownerSelfLabel.value);
   if (rule.owners?.includes('team')) parts.push('تیم‌های عضو');
-  if (rule.groupIds?.length) parts.push(`${rule.groupIds.length} گروه`);
   if (rule.sources?.length) parts.push(`${rule.sources.length} مورد منبع/نوع`);
   if (rule.moods?.length) parts.push(`${rule.moods.length} حال`);
   if (rule.pipelineIds?.length) parts.push(`${rule.pipelineIds.length} پایپ‌لاین`);
@@ -446,6 +452,9 @@ const filterSummary = computed(() => {
         فقط رکوردهایی دیده می‌شوند که با
         <strong>همهٔ فیلترهای پرشده</strong>
         جور باشند. در هر فهرست، چند انتخاب یعنی هر کدام کافی است. خالی یعنی بدون محدودیت.
+        <template v-if="isCustomers">
+          اعضای گروه‌هایی که این کاربر مسئولشان است جداگانه به همین محدوده اضافه می‌شوند (بدون تکرار).
+        </template>
       </p>
       <p v-if="hadMultipleRules" class="hint warn">
         تنظیم قبلی چندتکه بود؛ اینجا در یک فیلتر ادغام شده. با ذخیره به همین شکل ساده ثبت می‌شود.

apps/web/src/components/DataAccessPolicyPanel.vue

@@ -3,17 +3,19 @@ import { computed, onMounted, ref, watch } from 'vue';
 import type {
   DataAccessPolicy,
   DataAccessSection,
+  FinancialAccountDto,
   PersonImportSourceStatDto,
   RolePermissionKey,
   SectionDataAccess,
+  UserTreasuryAccess,
 } from '@mento/shared';
 import {
   DATA_ACCESS_SECTION_LABELS,
   DATA_ACCESS_SECTIONS,
+  ROLE_PERMISSION_ITEMS,
   emptySectionDataAccess,
 } from '@mento/shared';
 import { api } from '@/lib/api';
-import { useCustomerGroups } from '@/lib/customer-groups';
 import DataAccessEditor, { type IdOption } from '@/components/DataAccessEditor.vue';
 
 const props = defineProps<{
@@ -21,11 +23,16 @@ const props = defineProps<{
   /** فقط بخش‌هایی که این مجوزها را دارند نشان بده؛ خالی = همه */
   enabledPermissions?: RolePermissionKey[];
   disabled?: boolean;
+  /** تب‌های عمق داده قفل شوند؛ تب مدیریت مالی جدا می‌ماند */
+  dataLocked?: boolean;
+  showTreasury?: boolean;
+  treasuryAccess?: UserTreasuryAccess | null;
   compact?: boolean;
 }>();
 
 const emit = defineEmits<{
   'update:modelValue': [DataAccessPolicy];
+  'update:treasuryAccess': [UserTreasuryAccess | null];
 }>();
 
 /** بخش‌هایی که به RolePermissionKey وصل‌اند؛ بقیه (روتین/پروژه/تیکت) همیشه دیده می‌شوند */
@@ -47,12 +54,13 @@ const visibleSections = computed(() => {
   });
 });
 
-const active = ref<DataAccessSection>('customers');
+const treasurySections = ROLE_PERMISSION_ITEMS.filter((item) => item.key.startsWith('treasury_'));
+const active = ref<DataAccessSection | 'treasury'>('customers');
 
 watch(
   visibleSections,
   (list) => {
-    if (!list.includes(active.value) && list[0]) active.value = list[0];
+    if (active.value !== 'treasury' && !list.includes(active.value) && list[0]) active.value = list[0];
   },
   { immediate: true },
 );
@@ -76,7 +84,6 @@ function setSection(key: DataAccessSection, next: SectionDataAccess) {
   });
 }
 
-const { groups: customerGroups, load: loadCustomerGroups } = useCustomerGroups();
 const importSources = ref<Array<{ value: string; label: string }>>([]);
 const importSourcesReady = ref(false);
 const importSourcesFailed = ref(false);
@@ -89,9 +96,50 @@ const activityTypes = ref<IdOption[]>([]);
 const projectBoards = ref<IdOption[]>([]);
 const projectStages = ref<IdOption[]>([]);
 const routineCategories = ref<IdOption[]>([]);
+const treasuryAccounts = ref<FinancialAccountDto[]>([]);
+const treasuryAccountQuery = ref('');
+
+const filteredTreasuryAccounts = computed(() => {
+  const query = treasuryAccountQuery.value.trim();
+  if (!query) return treasuryAccounts.value;
+  return treasuryAccounts.value.filter((account) => account.name.includes(query));
+});
+
+function emptyTreasuryAccess(): UserTreasuryAccess {
+  return { enabled: true, sections: [], ownAccounts: false, accountIds: [] };
+}
+
+function patchTreasury(next: UserTreasuryAccess | null) {
+  emit('update:treasuryAccess', next);
+}
+
+function toggleTreasurySection(key: RolePermissionKey) {
+  const current = props.treasuryAccess ?? emptyTreasuryAccess();
+  const sections = current.sections.includes(key)
+    ? current.sections.filter((item) => item !== key)
+    : [...current.sections, key];
+  patchTreasury({ ...current, enabled: true, sections });
+}
+
+function toggleTreasuryAccount(id: string) {
+  const current = props.treasuryAccess ?? emptyTreasuryAccess();
+  const accountIds = current.accountIds.includes(id)
+    ? current.accountIds.filter((item) => item !== id)
+    : [...current.accountIds, id];
+  patchTreasury({ ...current, enabled: true, accountIds });
+}
+
+async function loadTreasuryAccounts() {
+  if (!props.showTreasury) return;
+  try {
+    const { data } = await api.get<FinancialAccountDto[]>('/treasury/accounts');
+    treasuryAccounts.value = data;
+  } catch {
+    treasuryAccounts.value = [];
+  }
+}
 
 async function loadOptions() {
-  await loadCustomerGroups().catch(() => undefined);
   try {
     const { data } = await api.get<PersonImportSourceStatDto[]>('/people/source-stats');
     importSources.value = data.map((row) => ({ value: row.source, label: row.label }));
@@ -176,8 +224,13 @@ async function loadOptions() {
 
 onMounted(() => {
   void loadOptions();
+  void loadTreasuryAccounts();
 });
 
+const editorSection = computed<DataAccessSection>(() =>
+  active.value === 'treasury' ? 'customers' : active.value,
+);
+
 const stagesForActive = computed(() => {
   if (active.value === 'leads') return leadStages.value;
   if (active.value === 'sales') return dealStages.value;
@@ -218,12 +271,94 @@ const typesForActive = computed(() => {
         >
           {{ DATA_ACCESS_SECTION_LABELS[s] }}
         </button>
+        <button
+          v-if="showTreasury"
+          type="button"
+          class="tab"
+          :class="{ on: active === 'treasury' }"
+          role="tab"
+          :aria-selected="active === 'treasury'"
+          @click="active = 'treasury'"
+        >
+          مدیریت مالی
+        </button>
+      </div>
+      <div v-if="active === 'treasury'" class="treasury">
+        <p class="muted">
+          این برگه فقط برای همین کاربر است. «مثل نقش» یعنی همان دسترسی مالی نقش بماند.
+          در حالت سفارشی، اگر هیچ بخش ریزی تیک نخورد همه بخش‌ها به‌جز حقوق باز می‌مانند و حقوق جداست.
+          اگر هیچ حسابی انتخاب نشود همه حساب‌ها باز است.
+        </p>
+        <label class="choice">
+          <input
+            type="radio"
+            name="user-treasury"
+            :checked="treasuryAccess == null"
+            :disabled="disabled"
+            @change="patchTreasury(null)"
+          />
+          مثل نقش
+        </label>
+        <label class="choice">
+          <input
+            type="radio"
+            name="user-treasury"
+            :checked="treasuryAccess != null"
+            :disabled="disabled"
+            @change="patchTreasury(treasuryAccess ?? emptyTreasuryAccess())"
+          />
+          سفارشی برای این کاربر
+        </label>
+        <template v-if="treasuryAccess">
+          <label class="choice">
+            <input
+              type="checkbox"
+              :checked="treasuryAccess.enabled"
+              :disabled="disabled"
+              @change="patchTreasury({ ...treasuryAccess, enabled: !treasuryAccess.enabled })"
+            />
+            دسترسی به مدیریت مالی
+          </label>
+          <template v-if="treasuryAccess.enabled">
+            <label v-for="perm in treasurySections" :key="perm.key" class="choice sub">
+              <input
+                type="checkbox"
+                :checked="treasuryAccess.sections.includes(perm.key)"
+                :disabled="disabled"
+                @change="toggleTreasurySection(perm.key)"
+              />
+              {{ perm.label }}
+            </label>
+            <label class="choice">
+              <input
+                type="checkbox"
+                :checked="treasuryAccess.ownAccounts"
+                :disabled="disabled"
+                @change="patchTreasury({ ...treasuryAccess, ownAccounts: !treasuryAccess.ownAccounts })"
+              />
+              حساب‌هایی که خودش مسئول آن‌هاست
+            </label>
+            <p class="muted">حساب‌های دیگر</p>
+            <input v-model="treasuryAccountQuery" placeholder="جستجوی حساب" :disabled="disabled" />
+            <label v-for="account in filteredTreasuryAccounts" :key="account.id" class="choice">
+              <input
+                type="checkbox"
+                :checked="treasuryAccess.accountIds.includes(account.id)"
+                :disabled="disabled"
+                @change="toggleTreasuryAccount(account.id)"
+              />
+              {{ account.name }}
+              <template v-if="account.responsibleName"> — مسئول: {{ account.responsibleName }}</template>
+            </label>
+            <p v-if="!treasuryAccounts.length" class="muted">حسابی برای انتخاب نیست.</p>
+          </template>
+        </template>
       </div>
       <DataAccessEditor
+        v-else
         :key="active"
-        :section="active"
-        :model-value="sectionValue(active)"
-        :groups="customerGroups"
+        :section="editorSection"
+        :model-value="sectionValue(editorSection)"
         :stages="stagesForActive"
         :pipelines="pipelines"
         :boards="boardsForActive"
@@ -231,9 +366,9 @@ const typesForActive = computed(() => {
         :import-sources="importSources"
         :import-sources-ready="importSourcesReady"
         :import-sources-failed="importSourcesFailed"
-        :disabled="disabled"
+        :disabled="disabled || dataLocked"
         :compact="compact"
-        @update:model-value="setSection(active, $event)"
+        @update:model-value="setSection(editorSection, $event)"
       />
     </template>
   </div>
@@ -268,4 +403,17 @@ const typesForActive = computed(() => {
   color: #64748b;
   font-size: 0.85rem;
 }
+.treasury {
+  display: grid;
+  gap: 0.45rem;
+}
+.choice {
+  display: grid;
+  grid-template-columns: auto 1fr;
+  gap: 0.4rem;
+  align-items: center;
+}
+.choice.sub {
+  padding-inline-start: 1.2rem;
+}
 </style>

apps/web/src/components/ExcelImportFlow.vue.bak

@@ -1,568 +0,0 @@
-<script setup lang="ts">
-import { computed, reactive, ref } from 'vue';
-import axios from 'axios';
-import { api } from '@/lib/api';
-import type {
-  ExcelFieldOption,
-  ExcelImportPrepareStatus,
-  ExcelPreviewResult,
-  ImportContactsResult,
-} from '@mento/shared';
-import {
-  previewExcelClient,
-  readMappedRowsClient,
-  type ClientExcelReadOptions,
-} from '@/lib/excel-client';
-import { UiBusyOverlay, UiButton, UiModal, UiSelect } from '@/components/ui';
-
-const props = defineProps<{
-  previewPath: string;
-  importPath: string;
-  /** اگر باشد: ابتدا فقط فایل خوانده می‌شود، بعد تکه‌تکه وارد می‌شود (برای فایل‌های خیلی بزرگ) */
-  preparePath?: string;
-  /**
-   * ایمپورت مرورگرگرا: اکسل در مرورگر خوانده می‌شود و فقط JSON کوچک به API می‌رود.
-   * برای فایل‌های ده‌ها هزار ردیفی (جلوگیری از ۵۰۲ nginx).
-   */
-  rowsImportPath?: string;
-  clientAliases?: Record<string, string>;
-  clientFields?: ExcelFieldOption[];
-  /** تشخیص خروجی بدون‌هدر (مثل فعالیت دیدار) */
-  clientReadOptions?: ClientExcelReadOptions;
-  disabled?: boolean;
-}>();
-
-const useClientImport = computed(
-  () =>
-    Boolean(
-      props.rowsImportPath &&
-        props.clientAliases &&
-        props.clientFields?.length,
-    ),
-);
-
-const emit = defineEmits<{
-  start: [];
-  done: [result: ImportContactsResult];
-  fail: [message: string];
-  settled: [];
-}>();
-
-const input = ref<HTMLInputElement | null>(null);
-const pending = ref<File | null>(null);
-const preview = ref<ExcelPreviewResult | null>(null);
-const mapping = reactive<Record<string, string>>({});
-const submitting = ref(false);
-const phase = ref<'idle' | 'preview' | 'import'>('idle');
-const progressLabel = ref('');
-/** درصد ۰–۱۰۰؛ در مرحلهٔ خواندن فایل null */
-const progressPct = ref<number | null>(null);
-
-const requiredKeys = computed(
-  () => preview.value?.fields.filter((f) => f.required).map((f) => f.key) ?? [],
-);
-
-const mappedFields = computed(() => new Set(Object.values(mapping).filter(Boolean)));
-
-const canImport = computed(() => requiredKeys.value.every((key) => mappedFields.value.has(key)));
-
-const busyOpen = computed(() => submitting.value && phase.value !== 'idle');
-const busyMessage = computed(() => {
-  if (phase.value === 'import') {
-    return progressLabel.value || 'در حال ورود اطلاعات از اکسل…';
-  }
-  return 'در حال خواندن و بررسی فایل اکسل…';
-});
-const busyProgress = computed(() =>
-  phase.value === 'import' ? progressPct.value : null,
-);
-
-function pick() {
-  if (props.disabled || submitting.value) return;
-  input.value?.click();
-}
-
-function reset() {
-  pending.value = null;
-  preview.value = null;
-  submitting.value = false;
-  phase.value = 'idle';
-  progressLabel.value = '';
-  progressPct.value = null;
-  for (const key of Object.keys(mapping)) delete mapping[key];
-}
-
-function closeMapper() {
-  if (submitting.value) return;
-  reset();
-  emit('settled');
-}
-
-function setColumnField(header: string, field: string) {
-  if (field) {
-    for (const [col, current] of Object.entries(mapping)) {
-      if (col !== header && current === field) mapping[col] = '';
-    }
-  }
-  mapping[header] = field;
-}
-
-function mergeImportResults(
-  acc: ImportContactsResult,
-  part: ImportContactsResult,
-): ImportContactsResult {
-  const errors = [...acc.errors, ...(part.errors ?? [])];
-  return {
-    created: acc.created + (part.created ?? 0),
-    skipped: acc.skipped + (part.skipped ?? 0),
-    errors: errors.slice(0, 200),
-    boardId: part.boardId ?? acc.boardId,
-    boards: part.boards?.length ? part.boards : acc.boards,
-    sessionId: part.sessionId,
-    total: part.total ?? acc.total,
-    processed: part.processed ?? acc.processed,
-    hasMore: part.hasMore,
-    nextOffset: part.nextOffset,
-  };
-}
-
-async function postImportChunk(opts: {
-  file?: File;
-  map?: Record<string, string>;
-  sessionId?: string;
-  offset?: number;
-}) {
-  const form = new FormData();
-  if (opts.file) form.append('file', opts.file);
-  if (opts.map && Object.values(opts.map).some(Boolean)) {
-    form.append('mapping', JSON.stringify(opts.map));
-  }
-  if (opts.sessionId) form.append('sessionId', opts.sessionId);
-  if (opts.offset != null) form.append('offset', String(opts.offset));
-  form.append('limit', '250');
-  const { data } = await api.post<ImportContactsResult>(props.importPath, form, {
-    headers: { 'Content-Type': undefined },
-    // خواندن فایل‌های خیلی بزرگ در مرحلهٔ اول ممکن است طول بکشد
-    timeout: opts.file ? 10 * 60 * 1000 : 3 * 60 * 1000,
-  });
-  return data;
-}
-
-function updateImportProgress(processed: number, total: number) {
-  if (total <= 0) {
-    progressPct.value = null;
-    progressLabel.value = 'در حال ورود اطلاعات از اکسل…';
-    return;
-  }
-  const pct = Math.max(0, Math.min(100, Math.round((processed / total) * 100)));
-  progressPct.value = pct;
-  progressLabel.value = `ورود فایل: ${processed.toLocaleString('fa-IR')} از ${total.toLocaleString('fa-IR')} ردیف`;
-}
-
-function sleep(ms: number) {
-  return new Promise((r) => setTimeout(r, ms));
-}
-
-async function postPrepare(file: File, map?: Record<string, string>) {
-  if (!props.preparePath) {
-    throw new Error('preparePath تنظیم نشده');
-  }
-  const form = new FormData();
-  form.append('file', file);
-  if (map && Object.values(map).some(Boolean)) {
-    form.append('mapping', JSON.stringify(map));
-  }
-  // فقط آپلود — پارس روی سرور ناهمگام است؛ تایم‌اوت کوتاه کافی است
-  const { data } = await api.post<ImportContactsResult>(props.preparePath, form, {
-    headers: { 'Content-Type': undefined },
-    timeout: 3 * 60 * 1000,
-  });
-  return data;
-}
-
-async function waitPrepareReady(sessionId: string) {
-  if (!props.preparePath) throw new Error('preparePath تنظیم نشده');
-  const statusUrl = `${props.preparePath}/${sessionId}`;
-  const started = Date.now();
-  const maxMs = 15 * 60 * 1000;
-  while (Date.now() - started < maxMs) {
-    const { data } = await api.get<ExcelImportPrepareStatus>(statusUrl, {
-      timeout: 30_000,
-    });
-    if (data.status === 'ready') {
-      progressLabel.value = `فایل آماده شد — ${data.total.toLocaleString('fa-IR')} ردیف`;
-      return data;
-    }
-    if (data.status === 'error') {
-      throw new Error(data.error || 'آماده‌سازی فایل اکسل ناموفق بود');
-    }
-    const parsed = data.parsed || 0;
-    progressPct.value = null;
-    progressLabel.value = parsed
-      ? `در حال خواندن فایل روی سرور… ${parsed.toLocaleString('fa-IR')} ردیف`
-      : 'در حال خواندن فایل روی سرور… لطفاً صبر کنید';
-    await sleep(1200);
-  }
-  throw new Error('آماده‌سازی فایل بیش از حد طول کشید. دوباره تلاش کنید.');
-}
-
-async function runClientRowsImport(file: File, map?: Record<string, string>) {
-  if (!props.rowsImportPath || !props.clientAliases) {
-    throw new Error('پیکربندی ایمپورت مرورگر ناقص است');
-  }
-  phase.value = 'import';
-  progressLabel.value = 'در حال خواندن فایل در مرورگر…';
-  progressPct.value = 0;
-
-  const rows = await readMappedRowsClient(
-    file,
-    props.clientAliases,
-    map,
-    props.clientReadOptions,
-  );
-  const total = rows.length;
-  if (total > 100_000) {
-    return {
-      created: 0,
-      skipped: 0,
-      errors: [{ row: 1, message: 'فایل بیش از ۱۰۰۰۰۰ ردیف دارد. فایل را تقسیم کنید.' }],
-      total,
-      processed: 0,
-      hasMore: false,
-    };
-  }
-
-  updateImportProgress(0, total);
-  let acc: ImportContactsResult = { created: 0, skipped: 0, errors: [] };
-  let sessionId: string | undefined;
-  const chunkSize = 60;
-
-  for (let offset = 0; offset < total; offset += chunkSize) {
-    const slice = rows.slice(offset, offset + chunkSize);
-    const { data: part } = await api.post<ImportContactsResult>(
-      props.rowsImportPath,
-      {
-        rows: slice,
-        offset,
-        total,
-        sessionId,
-      },
-      { timeout: 120_000 },
-    );
-    acc = mergeImportResults(acc, part);
-    updateImportProgress(part.processed ?? offset + slice.length, total);
-    if (part.errors?.some((e) => e.row === 1 && /حداکثر|بیش از/.test(e.message))) {
-      break;
-    }
-    sessionId = part.sessionId;
-    if (!part.hasMore) break;
-  }
-
-  updateImportProgress(total, total);
-  return acc;
-}
-
-async function runChunkedImport(file: File, map?: Record<string, string>) {
-  if (useClientImport.value) {
-    return runClientRowsImport(file, map);
-  }
-
-  phase.value = 'import';
-  progressLabel.value = 'در حال ارسال فایل…';
-  progressPct.value = 0;
-
-  let acc: ImportContactsResult = { created: 0, skipped: 0, errors: [] };
-  let sessionId: string | undefined;
-  let offset = 0;
-  let guard = 0;
-  const maxChunks = 2000;
-
-  if (props.preparePath) {
-    const prep = await postPrepare(file, map);
-    if (!prep.sessionId) {
-      throw new Error(prep.errors[0]?.message || 'آماده‌سازی فایل ناموفق بود');
-    }
-    sessionId = prep.sessionId;
-    progressLabel.value = 'در حال خواندن فایل روی سرور…';
-    const ready = await waitPrepareReady(sessionId);
-    if (!ready.total) {
-      return {
-        ...acc,
-        total: 0,
-        processed: 0,
-        hasMore: false,
-        errors: ready.error
-          ? [{ row: 1, message: ready.error }]
-          : [{ row: 1, message: 'هیچ ردیف داده‌ای در فایل نیست' }],
-      };
-    }
-    updateImportProgress(0, ready.total);
-  }
-
-  while (guard < maxChunks) {
-    guard += 1;
-    const part = await postImportChunk({
-      file: sessionId ? undefined : file,
-      map: sessionId ? undefined : map,
-      sessionId,
-      offset: sessionId ? offset : undefined,
-    });
-    acc = mergeImportResults(acc, part);
-
-    const total = part.total ?? 0;
-    const processed = part.processed ?? 0;
-    updateImportProgress(processed, total);
-
-    if (
-      part.errors?.some((e) => e.row === 1 && /بیش از .* ردیف/.test(e.message))
-    ) {
-      break;
-    }
-
-    if (!part.hasMore || !part.sessionId) {
-      if (total > 0) updateImportProgress(total, total);
-      break;
-    }
-    sessionId = part.sessionId;
-    offset = part.nextOffset ?? processed;
-  }
-
-  if (guard >= maxChunks && acc.hasMore) {
-    acc.errors = [
-      ...acc.errors,
-      {
-        row: 1,
-        message: 'ورود به‌خاطر تعداد مراحل زیاد متوقف شد. از جایی که مانده ادامه دهید یا فایل را تقسیم کنید.',
-      },
-    ];
-  }
-
-  return acc;
-}
-
-function apiMessage(e: unknown, fallback: string) {
-  if (!axios.isAxiosError(e)) {
-    return e instanceof Error && e.message ? e.message : fallback;
-  }
-  if (e.code === 'ECONNABORTED' || /timeout/i.test(e.message)) {
-    return 'مهلت درخواست تمام شد — فایل خیلی بزرگ است یا سرور دیر جواب داد. دوباره تلاش کنید.';
-  }
-  if (!e.response) {
-    return 'ارتباط با سرور برقرار نشد. اتصال را بررسی کنید و دوباره تلاش کنید.';
-  }
-  const status = e.response.status;
-  const data = e.response.data as { message?: string | string[] } | string | undefined;
-  let msg: string | undefined;
-  if (typeof data === 'string' && data.trim() && !data.trim().startsWith('<')) {
-    msg = data.trim().slice(0, 280);
-  } else if (data && typeof data === 'object') {
-    const m = data.message;
-    msg = Array.isArray(m) ? m.join('، ') : m;
-  }
-  if (msg) return msg;
-  if (status === 413) return 'حجم فایل بیش از حد مجاز سرور است.';
-  if (status === 502 || status === 504) {
-    return 'سرور میانی قطع شد (معمولاً به‌خاطر حجم/زمان فایل). چند دقیقه بعد دوباره تلاش کنید.';
-  }
-  return `${fallback} (کد ${status})`;
-}
-
-async function onFile(ev: Event) {
-  const el = ev.target as HTMLInputElement;
-  const file = el.files?.[0];
-  el.value = '';
-  if (!file) return;
-  emit('start');
-  submitting.value = true;
-  phase.value = 'preview';
-  try {
-    let data: ExcelPreviewResult;
-    if (useClientImport.value && props.clientAliases && props.clientFields) {
-      progressLabel.value = 'در حال خواندن فایل در مرورگر…';
-      data = await previewExcelClient(
-        file,
-        props.clientAliases,
-        props.clientFields,
-        props.clientReadOptions,
-      );
-    } else {
-      const form = new FormData();
-      form.append('file', file);
-      const res = await api.post<ExcelPreviewResult>(props.previewPath, form, {
-        headers: { 'Content-Type': undefined },
-        timeout: 5 * 60 * 1000,
-      });
-      data = res.data;
-    }
-    if (!data.needsMapping) {
-      try {
-        emit('done', await runChunkedImport(file));
-        reset();
-        emit('settled');
-      } catch (impErr) {
-        emit('fail', apiMessage(impErr, 'ایمپورت ناموفق بود'));
-        reset();
-        emit('settled');
-      }
-      return;
-    }
-    pending.value = file;
-    preview.value = data;
-    for (const col of data.columns) {
-      mapping[col.header] = data.suggested[col.header] ?? '';
-    }
-    phase.value = 'idle';
-    submitting.value = false;
-    // Allow parent toolbar while user maps columns.
-    emit('settled');
-  } catch (e) {
-    emit('fail', apiMessage(e, 'خواندن فایل اکسل ناموفق بود'));
-    reset();
-    emit('settled');
-  }
-}
-
-async function confirmMapping() {
-  if (!pending.value || !canImport.value || submitting.value) return;
-  emit('start');
-  submitting.value = true;
-  phase.value = 'import';
-  try {
-    emit('done', await runChunkedImport(pending.value, { ...mapping }));
-    reset();
-    emit('settled');
-  } catch (e) {
-    emit('fail', apiMessage(e, 'ایمپورت ناموفق بود'));
-    phase.value = 'idle';
-    submitting.value = false;
-    progressLabel.value = '';
-    progressPct.value = null;
-    emit('settled');
-  }
-}
-</script>
-
-<template>
-  <span class="excel-import" :class="{ isBusy: submitting }" @click.stop="pick">
-    <slot :loading="submitting" :disabled="disabled || submitting" />
-    <input
-      ref="input"
-      type="file"
-      accept=".xlsx,application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"
-      hidden
-      :disabled="disabled || submitting"
-      @change="onFile"
-      @click.stop
-    />
-  </span>
-
-  <UiBusyOverlay
-    :open="busyOpen"
-    :message="busyMessage"
-    :progress="busyProgress"
-    nest
-  />
-
-  <UiModal :open="!!preview" title="تطبیق ستون‌های اکسل" @close="closeMapper">
-    <p class="lead">
-      ستون‌های این فایل با قالب سیستم یکی نیست. مشخص کنید هر ستون فایل در کدام فیلد ریخته شود.
-    </p>
-    <p v-if="preview?.largeFile" class="large-hint">
-      فایل بزرگ است ({{ (preview.rowCount ?? 0).toLocaleString('fa-IR') }} ردیف) — ورود به‌صورت چندمرحله‌ای انجام می‌شود.
-    </p>
-    <div class="rows">
-      <div v-for="col in preview?.columns ?? []" :key="col.header" class="row">
-        <div class="source">
-          <strong>{{ col.header }}</strong>
-          <small v-if="col.samples.length">نمونه: {{ col.samples.join('، ') }}</small>
-        </div>
-        <UiSelect
-          :model-value="mapping[col.header] ?? ''"
-          :disabled="submitting"
-          @update:model-value="setColumnField(col.header, $event)"
-        >
-          <option value="">نادیده بگیر</option>
-          <option v-for="field in preview?.fields ?? []" :key="field.key" :value="field.key">
-            {{ field.label }}{{ field.required ? ' *' : '' }}
-          </option>
-        </UiSelect>
-      </div>
-    </div>
-    <p v-if="!canImport" class="hint">فیلدهای ستاره‌دار را حتماً به یک ستون وصل کنید.</p>
-    <template #footer>
-      <UiButton variant="ghost" :disabled="submitting" @click="closeMapper">انصراف</UiButton>
-      <UiButton :disabled="!canImport" :loading="submitting" @click="confirmMapping">
-        ورود فایل
-      </UiButton>
-    </template>
-  </UiModal>
-</template>
-
-<style scoped>
-.excel-import {
-  display: inline-flex;
-}
-
-.excel-import.isBusy {
-  pointer-events: none;
-  opacity: 0.7;
-}
-
-.lead {
-  margin: 0 0 1rem;
-  color: var(--muted);
-  line-height: 1.7;
-}
-
-.large-hint {
-  margin: -0.35rem 0 1rem;
-  padding: 0.55rem 0.75rem;
-  border-radius: 10px;
-  background: color-mix(in srgb, var(--accent, #2563eb) 12%, transparent);
-  color: var(--fg, inherit);
-  font-size: 0.88rem;
-  line-height: 1.6;
-}
-
-.rows {
-  display: grid;
-  gap: 0.75rem;
-}
-
-.row {
-  display: grid;
-  grid-template-columns: minmax(0, 1.1fr) minmax(0, 0.9fr);
-  gap: 0.75rem;
-  align-items: center;
-}
-
-.source {
-  display: grid;
-  gap: 0.2rem;
-  min-width: 0;
-}
-
-.source strong {
-  font-size: 0.95rem;
-}
-
-.source small {
-  color: var(--muted);
-  font-size: 0.78rem;
-  overflow: hidden;
-  text-overflow: ellipsis;
-  white-space: nowrap;
-}
-
-.hint {
-  margin: 0.85rem 0 0;
-  color: var(--danger);
-  font-size: 0.85rem;
-}
-
-@media (max-width: 700px) {
-  .row {
-    grid-template-columns: 1fr;
-  }
-}
-</style>